Apple patches eMudhra certificate flaw in macOS command-line tools
Apple’s macOS 27.2.1 update stops command-line tools such as curl and git from accepting compromised eMudhra certificates. The fix is also included in macOS 26.7.3 and 15.8.3; Apple says Safari, Mail and apps using its frameworks were already blocking the certificates.
Bottom line — Apple says the update blocks 12 affected certificates in command-line tools and removes several related roots from the system certificate file.
Go deeper 6
-
Apple says keys belonging to eight eMudhra intermediate certificate authorities were compromised; six issued TLS certificates that could appear valid for any website.
-
Mozilla’s investigation, reported by MacRumors, found the certificates used private key values below 256, making them easy to recover.
-
Apple says eMudhra and Sectigo have revoked the affected certificates.
-
Apple’s support guidance says tools including curl, git, python3, ruby, perl and openssl can use /etc/ssl/cert.pem and may not check Apple’s certificate block.
-
Apple advises users who cannot update to remove affected root certificates manually; it warns this can prevent some tools from verifying websites whose certificates chain through unaffected intermediates.
-
Apple says apps and tools that carry their own certificate lists may not use its block or /etc/ssl/cert.pem.