What happened
Eight eMudhra intermediate certificate authorities were found to have private keys that can be calculated from their public certificates. Six issue website (TLS) certificates and two issue code signing certificates; with Sectigo’s cross-signs, 16 certificates are affected (independent, Tanium; Fleet). eMudhra and Sectigo revoked their certificates on 18 and 19 October.
Apple began blocking the affected certificates on its devices on 19 October, and the emSign ECC Root CA - G3 above them on 23 October. No software update was needed for Safari, Mail, or apps (vendor, Apple Support).
The gap Apple left
The same Apple article says command-line tools such as curl and git check certificates against /etc/ssl/cert.pem and “can still accept these certificates until a future software update”. It lists git, python3, ruby, perl, and openssl as well (vendor). MacRumors reported on 25 October that Apple is working on that update and has given no release date (independent, MacRumors).
Fleet’s test on macOS 26.5.1: /usr/bin/curl returned 200 from a server using one of the compromised intermediates, while Apple’s own nscurl refused it (independent, Fleet). Asked on Apple’s developer forum whether cert.pem would be updated, Apple’s DTS engineer said that was “about The Future” and not something he could comment on (independent, Apple Developer Forums).
Why that matters to a buyer: git and curl are how developer laptops and macOS build runners fetch source code, packages, and installers. A Mac that blocks a forged site in Safari can still pull from one in a terminal. Exploiting it needs an attacker who holds one of the derivable keys and sits in the network path. That is a narrow attack. It is also exactly the attack a compromised CA enables.
Runtime by runtime
| Where the check happens | Status reported | Action |
|---|---|---|
| Safari, Mail, and apps on Apple frameworks | Blocked since 19 Oct (vendor) | None |
/usr/bin curl, git, python3, ruby, perl, openssl on macOS | Still accept until a future update (vendor) | Decide per fleet: Steps 3 and 4 |
| Go programs | Go 1.27.3 blocks the eight intermediates; programs must be rebuilt (independent) | Rebuild internal Go tools and agents |
| Standalone Java runtimes | Current releases alone do not fix them (independent, Tanium) | Remove the two root aliases or enable revocation checks, after checking Sectigo dependencies |
| Windows | Microsoft’s disallowed list, dated 19 Oct, lists all eight keys (independent, Tanium) | Confirm devices and internal mirrors synced on or after 21 Oct (Fleet) |
| Linux | ca-certificates updates shipped for Red Hat, Debian, Ubuntu, and Oracle Linux (independent, Tanium) | Update the package; check images and base layers |
The trade-off nobody reconciles
Apple’s optional workaround is to remove emSign ECC Root CA - G3, and optionally AAA Certificate Services, from cert.pem. Apple warns this may stop some websites verifying, and that a software update can restore the file (vendor). Tanium goes further: about 30,800 unexpired certificates chain to emSign ECC Root CA - G3, most from InCommon intermediates, and it advises against removing the roots by hand (independent).
Pointing a tool at a different CA bundle does not escape that trade-off. The developer on Apple’s forum showed that Homebrew’s ca-certificates bundle, which lacks both roots, makes the same request fail (independent). Any bundle without those roots will also refuse sites that chain to them legitimately.
So the choice is not which fix is safe. It is where the breakage is acceptable. A build runner that fetches from a short, known list of hosts can lose the roots with little risk and a test to prove it. A developer laptop that talks to anything cannot be tested in advance. Editing the operating system’s file is undone by the next update; a bundle set in a runner’s configuration is scoped, logged, and reversible.
Six steps
- Step 1. Inventory. List the managed Macs and macOS CI runners that fetch code or packages with the system curl, git, or python3. Owner: endpoint engineering.
- Step 2. Test. Run
/usr/bin/curlagainst the public test hostdv-g3b-emudhra.we-have-a-problem.com. A successful connection means that machine still trusts the compromised intermediates. Owner: security engineering. - Step 3. CI runners first. Configure the runners’ tools to use a maintained CA bundle without the two roots. Prove the test host now fails and every host the runner depends on still verifies. Owner: platform engineering.
- Step 4. Laptops, by decision. Add an MDM check for the two roots in cert.pem (Fleet publishes a query). Either remove them with a script that keeps a backup and re-runs after updates, or accept the exposure until Apple ships. Write the decision down. Owner: CISO.
- Step 5. Everything that is not macOS. Rebuild Go tools on 1.27.3 or later, fix standalone Java runtimes, update ca-certificates on Linux images, and confirm Windows synced. Owner: platform engineering.
- Step 6. Revert. When Apple’s update lands, re-run Step 2 on a clean machine and remove the overrides. Owner: endpoint engineering.
Distrusting the roots is Apple’s job. Knowing which of your machines still trust them is ours.
Missing
- A date, or even a version, for Apple’s cert.pem update.
- Any count of affected enterprise Macs or CI runners. Nobody has published one.
- A single disclosure date. Tanium says a researcher reported the keys on 17 October; Fleet dates Mozilla’s disclosure to 20 October.
- Evidence of use. We found no report of the derivable keys being used in an attack.
Frequently asked questions
Are our Macs exposed if Safari already blocks these certificates?
Partly. Apple says Safari, Mail, and apps that use its frameworks block the certificates automatically. It also says curl, git, python3, ruby, perl, and openssl check /etc/ssl/cert.pem and can still accept them until a future software update.
Should we delete the emSign root from cert.pem?
Not as a blanket fix. Apple offers it as an optional workaround and warns some websites may stop verifying. Tanium reports about 30,800 unexpired certificates chain to that root and advises against removing it by hand. Scope any change to the machines that need it, starting with CI runners.
How do we know whether a Mac is affected?
Fleet and a developer on Apple’s forum both use the public test host dv-g3b-emudhra.we-have-a-problem.com. If /usr/bin/curl connects to it without an error, that tool still trusts the compromised intermediates.
Living page. Last updated 29 Oct 2026. We update this note when Apple ships the cert.pem change or reports use of the keys.