Apple has fully blocked the compromised eMudhra certificates in macOS 27.3 developer beta 1, closing a major security loophole. The certificates, discovered in October, were astoundingly weak — some using just the digit '4' as a private key. While Apple had already blocked them on iOS and iPadOS, the curl utility in macOS bypassed revocation checks, allowing trusted Macs to continue accepting them. The new update ensures even previously trusted certificates are rejected. Google and Mozilla moved first on October 17, followed by Apple on iOS and iPadOS on October 19. Of the eight flawed certificates, six were for TLS and two for code signing. Though generated in April 2025, most never reached production, and there’s no evidence of exploitation. Apple also provides manual removal instructions for administrators. The fix is expected in the public macOS 27.3 release in December, possibly earlier in a 27.2.1 update.
This patch ends one of the most embarrassing security oversights in recent memory, reinforcing Apple’s commitment to integrity across its ecosystem.
Source: AppleInsider · Summarized by HeadlinesBriefing