> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Macs block the hacked eMudhra certificates, except in curl, git and other Terminal tools
- URL: https://www.skimwire.com/apple-emudhra-certificates-mac-curl-git-fix/
- Published: 2026-10-26T12:46:49.000Z
- Updated: 2026-10-26T12:46:49.000Z
- Description: Safari and Mail are covered, but macOS command-line tools can still trust the weak eMudhra certificates until an update. Apple's fix steps.
- Author: Jeremy Moon
- Tags: Security

## The skim

- Apple says Safari, Mail and most Mac and iPhone apps have blocked the compromised eMudhra web certificates since Oct. 19, with no update needed.
- The gap is Terminal: curl, git, python3 and other command-line tools built into macOS check a separate certificate file and "can still accept these certificates until a future software update," Apple says. It hasn't given a date.
- Developers and IT admins who don't want to wait can remove two root certificates from that file, using steps Apple published. Everyone else doesn't need to do anything.

## What happened

Last week, a researcher told Apple, Google, Microsoft and Mozilla that the private keys behind eight intermediate certificates from eMudhra, an Indian certificate authority, could be computed from the public certificates. Security researcher Scott Helme recovered all eight on his laptop in under a second, [CyberScoop reports](https://cyberscoop.com/emudhra-shuts-down-certificate-business-weak-private-keys/?ref=skimwire.com). Each key was a whole number below 256, and one was simply the number 4\. Six of the eight issue TLS certificates, the ones that prove a website is real. Anyone with those keys could create certificates that look valid for any website, which makes it possible to impersonate sites and intercept traffic.

eMudhra blamed an error in an April 2025 key generation ceremony and said none of the eight had issued certificates to websites. Whether anyone used the keys isn't known. India's CERT-In said it had seen no malicious use as of Oct. 21\. Browsers moved fast: Chrome and Firefox blocked the certificates within hours, Apple followed on Oct. 19 and Microsoft a day later. eMudhra said Oct. 22 that it will stop issuing SSL/TLS certificates altogether.

## The Mac gap

In a [support document](https://support.apple.com/en-us/149555?ref=skimwire.com), Apple says it is blocking 12 certificates tied to the six TLS authorities, and on Oct. 23 it also began blocking eMudhra's emSign ECC Root CA - G3\. Those blocks reach devices automatically.

But some tools included with macOS or the Xcode Command Line Tools, "including curl, git, python3, ruby, perl, and openssl," check certificates against /etc/ssl/cert.pem. For certificates that chain to a root in that file, Apple says, those tools don't check its block or whether a certificate was revoked. Apple will fix the file in a future macOS update, [MacRumors notes](https://www.macrumors.com/2026/10/25/apple-blocks-compromised-emudhra-certificates/?ref=skimwire.com), without a release date.

## Why it matters

Command-line tools fetch code, packages and updates, so they're exactly where a forged certificate could do damage on a developer's Mac. The risk looks low for now, with no known misuse, but the fix is in your hands until Apple ships the update.

## What to do

- **If you don't use Terminal:** nothing. You're covered.
- **If you do:** Apple's support page has copy-and-paste commands to back up /etc/ssl/cert.pem and remove emSign ECC Root CA - G3\. Removing AAA Certificate Services too blocks the six Sectigo cross-signed certificates, but may break other sites that chain to that root, Apple warns.
- **After any macOS update** until the fix arrives, re-run Apple's check command, because an update can restore the original file.
- **Tools that bring their own certificate list**, like some apps installed with package managers, don't use Apple's file. Update them or ask their developers. Go, Node.js, Python's certifi package and several Linux distributions have already shipped fixes, according to CyberScoop.

*Sources:* [*Apple Support*](https://support.apple.com/en-us/149555?ref=skimwire.com)*,* [*MacRumors*](https://www.macrumors.com/2026/10/25/apple-blocks-compromised-emudhra-certificates/?ref=skimwire.com)*,* [*CyberScoop*](https://cyberscoop.com/emudhra-shuts-down-certificate-business-weak-private-keys/?ref=skimwire.com)*,* [*Google*](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/?ref=skimwire.com) *and* [*eMudhra*](https://emudhra.com/en/post/certificate-security-incident?ref=skimwire.com)*.*