macOS 27.2.1 finally stops curl and git from trusting eMudhra certs
macOS 27.2.1, Tahoe 26.7.3 and Sequoia 15.8.3 close the eMudhra gap in Mac command-line tools. Update now.
Workspace · Macfolio · 10 November 2026
Apple has shipped its promised fix for Mac command-line tools that could still trust the compromised eMudhra certificate authorities. macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 and macOS Sequoia 15.8.3 all arrived on November 9, 2026, and Apple's updated support document now tells Mac users to simply update instead of editing system files by hand.
What changed in macOS 27.2.1
Since October, Apple has blocked the 12 affected intermediate certificates in Safari, Mail and apps that use its networking and security frameworks, via automatic certificate configuration updates. The gap was the tools that read "/etc/ssl/cert.pem" directly. Apple lists curl, git, python3, ruby, perl and openssl among the built-in or Xcode Command Line Tools that check that file and skip Apple's block and revocation checks.
According to Apple, the new releases:
- Block the 12 certificates in command-line tools included with macOS or the Xcode Command Line Tools
- Remove the two root CA certificates those 12 chain to from "/etc/ssl/cert.pem"
- Also remove three other eMudhra root CA certificates from that file
- Apply the same protection on Tahoe 26.7.3 and Sequoia 15.8.3
Who should act, and how
Anyone running scripts, CI jobs or git over HTTPS on a Mac should update via System Settings, General, Software Update. If you followed Apple's earlier manual workaround, Apple says you no longer need to repeat it after updating, you can delete the backup with "sudo rm /etc/ssl/cert.pem.orig", and you should not restore a backup made before the update.
This does not cover every tool. Apple notes that some apps and tools ship their own root certificate list and ignore both Apple's block and "/etc/ssl/cert.pem"; separately installed runtimes may be among them, so check with those vendors.
Our take: this is the update Mac admins were waiting for. The gap was easy to miss because Safari looked fine while Terminal did not. Push it through device management this week, especially on build machines.
Caveats: Apple has not said whether any fraudulent certificates were used against Mac users, and Macs that cannot run Sequoia or later still need the manual steps.