Apple blocks eight compromised certificates after private keys prove guessable
Apple added protections for eight compromised eMudhra certificates in iOS and iPadOS on 19 October, two days after Google and Mozilla acted, according to AppleInsider and Hitechreports. Mozilla engineers recovered the certificates’ private keys easily; most certificates reportedly never entered production, and researchers have found no evidence that attackers used them.
Bottom line — Macs may still trust certificates they have accepted before because macOS’s built-in curl does not check revocation status.
Go deeper 6
-
The eight private keys were the numbers 4, 56, 66, 115, 155, 156, 230 and 237, AppleInsider reports.
-
Six certificates were for TLS and trusted by root programmes from Apple, Google, Microsoft and Mozilla; two were for code signing and trusted by Microsoft, Hitechreports says.
-
The certificates were generated in April 2025, according to AppleInsider.
-
Mozilla used Firefox’s OneCRL system to block the certificates without requiring a browser update or restart, Hitechreports reports.
-
eMudhra said there was no breach of its infrastructure or evidence of customer data exposure, and that it is working with affected customers to replace certificates.
-
AppleInsider advises Apple users to update their software; it notes that Mac users may need particular caution because curl does not check revocation information.