Apple Blocks Certificates After eMudhra Intermediate CA Private Key Leak, Publishes Workarounds for curl and git

What happened

eMudhra is an Indian company that issues digital certificates. Those certificates prove that a website or file is genuine. A security researcher found that eMudhra had made weak cryptographic keys for eight intermediate certificates and made them public. Apple began blocking the affected certificates on October 19, 2026. On October 23, Apple also added the root certificate "emSign ECC Root CA - G3" to the block list.

Key facts

• eMudhra runs 8 intermediate certificate authorities (CAs).
• Apple blocks 12 certificates linked to 6 intermediate CAs that issue TLS certificates (the certificates that secure websites).
• The weak keys were created on April 30, 2025. The problem was found about 18 months later.
• Apple's block started on October 19, 2026, and the root certificate was added on October 23.

Why command-line tools are different

Apple's apps, such as Safari and Mail, block the bad certificates automatically. Command-line tools like curl, git, python3, ruby, perl, and openssl read a list of trusted certificates from the file /etc/ssl/cert.pem. That file is not updated yet, so these tools still trust the bad certificates. Apple says it will fix this in a future update.

Temporary workaround

• Back up /etc/ssl/cert.pem first.
• Remove the "emSign ECC Root CA - G3" root certificate from the file.
• Optional: also remove the "AAA Certificate Services" root certificate, which Sectigo used to cross-sign six of the affected certificates.
• Use a grep command with openssl to check that both root certificates are gone.
• Apple says a software update will refresh cert.pem. Check Apple's official support page for the latest steps.

Why it matters

Digital certificates are a key part of internet security. If a certificate authority's private keys leak, attackers could pretend to be real websites. Developers and system administrators who use command-line tools need to act now, because those tools will keep trusting the bad certificates until Apple's update arrives.