Apple confirms eMudhra fix for Mac command-line tools needs a macOS update
Safari and Mail already block the bad certificates, but curl, git, and python3 trust a stale file until a macOS fix.
Workspace · Macfolio · 26 October 2026
Apple has now put its own name on the eMudhra certificate cleanup. In a support document published October 23, 2026, Apple confirms that Safari and Mail are protected, and that some command-line tools on the Mac still are not. Our October 22 report relied on Mozilla's incident details, since Apple had not commented.
What Apple confirms
- Eight eMudhra intermediate CAs had compromised keys. Two issue code signing certificates, which Apple's frameworks do not trust; six issue TLS certificates.
- Each of those six has two certificates, one under emSign Root TLS CA - G3 and one cross-signed by Sectigo under "AAA Certificate Services," for 12 in total. Apple lists all 12 with SHA-256 fingerprints.
- Apple began blocking the 12 certificates on October 19 and added the emSign ECC Root CA - G3 root to the block on October 23. Both changes arrive automatically, with no software update.
- Safari, Mail, and apps built on Apple's networking and security frameworks are covered.
The part that still needs a macOS update
Apple says tools that ship with macOS or the Xcode Command Line Tools, including curl, git, python3, ruby, perl, and openssl, check certificates against /etc/ssl/cert.pem. For chains that reach a root in that file, they ignore Apple's block and revocation status. Apple says a future macOS update will fix the file, with no manual edits needed, but gives no date or version. The current release is macOS 27.0.1, and macOS 27.2 is still a release candidate.
Admins who do not want to wait can follow Apple's steps: back up the file, remove emSign ECC Root CA - G3, and optionally remove AAA Certificate Services to stop the six Sectigo cross-signed certificates. Apple warns that removing roots can break verification for unaffected sites, and that a macOS update can restore the file, so the check must be repeated after each update. Steps can be deployed through device management.
Apps that bundle their own root list, such as many Python, Node, or Go toolchains, depend on their developers.
This does not mean Macs were attacked. There is still no public evidence the keys were misused.
Our take: Apple's note is clearer than the earlier third-party guidance. For most fleets, updating your own toolchains and waiting for the macOS fix is safer than editing a system file you must re-check after every update.
Caveat: we have not tested Apple's commands; read the full document before deploying them.