Apple has released new updates for macOS that address a lingering security vulnerability involving compromised digital certificates from the Indian provider eMudhra. The updates, which include macOS 27.2.1, macOS 26.7.3, and macOS 15.8.3, specifically target command-line tools that were previously excluded from earlier protections.
The issue stems from a compromise of private keys belonging to eight intermediate certificate authorities operated by eMudhra. These certificates are critical for establishing trust in digital identities and enabling secure connections on the internet. When bad actors gain access to these private keys, they can create fraudulent certificates that appear legitimate, potentially allowing them to impersonate websites and intercept sensitive user data.
Command-line tools remain exposed
Apple initially responded to the threat in October by automatically blocking the affected certificates in Safari, Mail, and other applications that utilize Apple’s networking and security frameworks. These protections were deployed through automatic certificate configuration updates, meaning users did not need to install a full system update to be shielded in their primary browsing and email clients.
However, these measures did not cover all parts of the operating system. Certain command-line utilities, including curl and git, continued to accept the compromised certificates. This gap left administrators with a manual workaround to address the remaining security risk, as outlined in a support article published by Apple at the time.
The newly released updates finally close this loophole. By preventing affected command-line tools from accepting the compromised certificates, Apple has eliminated the need for manual intervention for most users. The updates also remove five root CA certificates from the system file /etc/ssl/cert.pem, including three additional eMudhra certificates that were not part of the original manual workaround.
Manual steps still available
For organizations or individuals unable to install the latest macOS updates immediately, Apple continues to provide instructions for manually addressing the issue in its support documentation. The guide includes the names and SHA-256 fingerprints of the 12 affected certificates, as well as the five root CA certificates removed by the new updates.
Apple also noted that some third-party apps and tools include their own list of root CA certificates and do not rely on Apple’s block or the /etc/ssl/cert.pem file. Users encountering issues with such applications are advised to contact the respective developers directly to ensure their tools are updated to handle the compromised certificates correctly.
Source: 9to5Mac
