Macs block bad eMudhra certificates, but built-in curl may still trust them

A certificate authority error has left a gap on Macs that developers and IT teams should know about. Eight intermediate certificates from the CA eMudhra were generated in April 2025 with private keys so weak that anyone could recover them, according to Mozilla's incident report. Six can issue TLS certificates and chain to roots trusted by Apple, Google, Microsoft, and Mozilla.

What happened

• October 17: a researcher reported the flaw to the root programs, including Apple's. The Mozilla bug timeline says Apple corroborated the findings that evening.
• October 18: eMudhra revoked all eight certificates.
• October 19: the certificates were blocked on Apple devices, according to the incident site run by Mozilla engineer Dennis Jackson. Firefox and Chrome blocked them on the 17th and Microsoft on the 20th.

Anyone holding those keys could impersonate any website. The incident site says no certificate transparency log entries exist for these intermediates, so browsers that enforce CT, Safari included, could not have been attacked. There is no public evidence the keys were abused.

The Mac gap

Apple has not published a notice. The incident site says macOS itself blocks the intermediates, but the built-in curl, git, python3, perl, ruby, and openssl check certificates against /etc/ssl/cert.pem without consulting revocation data, and that file has not been updated. It adds that the built-in pip3 relies on its own outdated copy of the roots.

That matters for scripts, CI runners, and install commands on Macs that fetch code over HTTPS, not for everyday browsing in Safari.

What to do

• Keep macOS current, since a future update is the clean fix for the bundled file.
• Update the toolchains you install yourself; the incident site lists patched versions of Python certifi, pip, Go, Node.js, Electron, and the curl CA bundle.
• Be careful with the site's manual workaround. It rewrites /etc/ssl/cert.pem with sudo and removes two whole roots, including Sectigo's "AAA Certificate Services," which can break other sites for those tools. Back up the file first.

This does not mean Macs are known to be under attack, or that Safari users need to change anything.

Our take: the system trust store did its job within two days. The weak spot is the older Unix layer that many admin scripts still depend on, and Apple should refresh it.

Caveat: Apple has not commented, and the Mac details come from Mozilla's engineer and could change once Apple ships an update.

Primary Sources

• eMudhra Intermediate CA Compromise incident site
• Mozilla Bugzilla: eMudhra private key compromise of intermediate certificates
• Mozilla Security Blog: Protecting Firefox users following the compromise of eMudhra intermediate certificates
• BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
• 9to5Mac: Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains