eMudhra's Leaked CA Keys Let Attackers Forge Certificates for Any Website
About the compromised eMudhra intermediate CAs
Apple is blocking certificates from eight compromised eMudhra intermediate CAs after their private keys leaked. Six of them issue TLS certificates, meaning anyone holding those keys could mint certificates that look valid for any site. Apple rolled out the block automatically on October 19, 2026, and added the emSign ECC Root CA - G3 on October 23. Command-line tools like curl and git still trust the certs via /etc/ssl/cert.pem until a future macOS update, so admins can strip the root CAs manually.
Someone with keys from these six CAs could create certificates that appear valid for any website.
- magnio
> On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don't check Apple's block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don't want to wait for the update, you can remove root CA certificates from the file.
What a clusterfuck
- mattstir
It's wild to see people supporting this bizarre anti-security response. Not only are they dragging their feet in fixing the security issue, they're actively reverting any manual fixes silently with each new update. That's legitimately worse than doing nothing at all! It's also disconcerting to see folks advocate for the "let's wait to fix this critical security issue because we want to make it slightly easier in the future" approach, as if Apple is incapable of deleting ~12 lines from a file as part of the normal patch release? If they can revert your manual fixes, they obviously ship that file and so could have shipped a fix with that file. Genuinely disturbing to support any of this.
- gwbas1c
I'd really like to know why it's taking Apple so long to ship a fix. Especially if they can explain how to update an existing computer, what's the general holdup? Is it their release process? Is there some underlying complexity that's poorly understood?
- pluc
Related: Ten days later, Git on macOS still trusts the compromised eMudhra certificates https://news.ycombinator.com/item?id=50271640
- lazzurs
This is some weak sauce. I've just ditched iPhone for GrapheneOS and Apple Watch for Pebble. I'm getting more convinced something like a Framework with Linux is the answer.