Apple has initiated a security measure to block certificates issued by eMudhra intermediate Certification Authorities (CAs) following a compromise of their private keys. The breach affected eight intermediate CAs; while two were used for code signing (which Apple's frameworks do not trust), the other six were used to issue Transport Layer Security (TLS) certificates. Because these keys were compromised, an attacker could potentially generate certificates that appear valid for any website. Both eMudhra and Sectigo have since revoked the affected certificates.
For most users, Apple's response is automated. Since October 19, 2026, Apple has been blocking these 12 specific certificates across Safari, Mail, and any applications utilizing Apple's networking and security frameworks. These blocks are delivered to devices automatically as certificate configuration data, meaning users do not need to manually install a software update to receive this protection. On October 23, 2026, Apple also began blocking the emSign ECC Root CA - G3.
A specific technical gap exists for users who rely on command-line tools such as curl, git, python3, ruby, perl, and openssl. These tools, included in macOS or the Xcode Command Line Tools, check certificates against a local file located at `/etc/ssl/cert.pem`. Unlike Apple's standard networking frameworks, these tools do not currently check Apple's blocklist or revocation status for certificates that chain to a root CA found in that specific file. While Apple plans to update this file in a future macOS release, system administrators and developers can manually remove the affected root CA certificates from `/etc/ssl/cert.pem` to achieve immediate protection for these tools. However, removing these root certificates may prevent the verification of legitimate websites that rely on those specific root CAs through unaffected intermediate CAs.