Apple today released macOS updates that address a security vulnerability involving compromised eMudhra certificates after initially blocking them from Safari, Mail and other apps in October. Here are the details.
A bit of context
a few weeks ago Mozilla informed about it that the private keys of eight intermediate certificate authorities operated by the Indian digital certificate company eMudhra have been compromised.
Essentially, these certificates are used to establish trust in digital certificates that verify the identities of websites and enable secure connections.
With access to compromised private keys, bad actors could potentially create fraudulent certificates that appear legitimate, allowing them to impersonate websites and capture sensitive user information.
In response to the compromise, Apple began automatically blocking affected certificates on October 19, and additional protections followed on October 23.
These changes were delivered via automatic certificate configuration updates, meaning users did not need to install a macOS update to be protected.
While these measures protected Safari, Mail, and apps that use Apple’s network and security frameworks, they did not cover all macOS, as some command-line tools, including curl and git, could still accept compromised certificates.
At the time, Apple published a support article with instructions for administrators to manually address this remaining security hole, while promising a fix in a future macOS update.
Today, Apple updated document to confirm that the fix is now available.
Apple closes remaining eMudhra security loophole
As Apple explains, macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, released today, prevent affected command-line tools from accepting compromised certificates, eliminating the need for administrators to address the issue manually.
The update also removes five root CA certificates from /etc/ssl/cert.pem, including three additional eMudhra certificates that were not part of Apple’s original manual solution.
Still, for users unable to install the latest macOS updates, Apple continues to provide manual troubleshooting instructions in its support document, along with the names and SHA-256 fingerprints of the 12 affected certificates and the five CA root certificates removed by the updates.
Apple also notes that “some applications and tools contain their own list of CA root certificates and do not use the Apple block or /etc/ssl/cert.pem” and recommends that users contact the developer these applications and tools.
To read the full Apple support document, follow this link.
It’s worth checking out on Amazon
FTC: We use automatic income earning affiliate links. More.
