Today’s macOS security updates close gap involving eMudhra certificates, 9to5Mac reports

Compromised keys raised risks

Mozilla reported that private keys belonging to eight intermediate certificate authorities operated by Indian digital certification company eMudhra had been compromised. These certificates help establish trust in digital certificates used to verify websites and secure connections.

With the keys, attackers could potentially create fraudulent certificates that appear legitimate. That could allow them to impersonate websites and intercept sensitive information.

Earlier protections had limits

The measures covered Safari, Mail and apps using Apple’s networking and security frameworks. However, some command-line tools, including curl and git, could still accept the compromised certificates, leaving a gap that Apple had told administrators to address manually.

Updates close remaining gap

Apple says macOS 27.2.1, macOS 26.7.3 and macOS 15.8.3, released today, prevent the affected command-line tools from accepting the certificates. The updates also remove five root CA certificates from /etc/ssl/cert.pem, including three eMudhra certificates not covered by Apple’s original manual workaround.

Apple continues to provide instructions for administrators and users who cannot install the updates. Its support document lists the names and SHA-256 fingerprints of 12 affected certificates and the five removed root CA certificates.

Apple cautions that some apps and tools use their own root certificate lists rather than Apple’s block or /etc/ssl/cert.pem. It advises users to contact the developers of those apps and tools.