Since October 19, 2026, Apple has been blocking certificates from eight compromised eMudhra intermediate Certification Authorities (CAs). The private keys of eight intermediate CAs operated by eMudhra were compromised. Two of these CAs issue code signing certificates, which Apple's frameworks don't trust.
The other six issue TLS certificates, allowing someone with keys to create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates. On October 23, 2026, Apple also began blocking the eMudhra Root CA - G3. Most users do not need to take action, as Apple devices automatically block these certificates in Safari, Mail, and apps using Apple's networking frameworks.
However, users relying on Terminal command-line tools may need to remove root CA certificates from /etc/ssl/cert.pem to prevent accepting the compromised certificates sooner. Apple plans to deliver updates automatically in future software updates, and users can manually remove affected certificates from the file if desired. Administrators are advised to remove root CA certificates to which the blocked certificates chain, though this may impact verification of unaffected websites.
A future macOS update will restore /etc/ssl/cert.pem.
Source: Hacker News · Summarized by HeadlinesBriefing