Apple has moved quickly to block a set of compromised certificates from Indian certificate authority eMudhra after discovery of cryptographic weaknesses in eight intermediate CAs. These flaws could have allowed attackers to forge valid website certificates and impersonate secure sites. Apple’s blocks affect Safari, Mail, and all apps using its security frameworks—and extend to command-line tools pending a future update.
What happened
On October 17, 2026, a researcher found that eight intermediate Tier-2 certificate authorities (CAs) operated by eMudhra had private keys that were disastrously weak. These weak keys, which anyone could reverse-engineer, came from a faulty key generation process. Although none of the flawed CAs is believed to have issued trusted certificates to end users, the breach exposed serious risk to web trust. Within hours, eMudhra revoked the affected intermediates, and major browser root programs distrusted the associated ECC root hierarchy. No evidence so far indicates data was exposed or infrastructure compromised. Sensitive services like digital signatures, eSign/eSignature, and enterprise TLS services not on the affected hierarchy continue to function normally.
Apple’s response & what users need to do
Starting October 19, Apple began automatically blocking 12 particular eMudhra certificates in Safari, Mail, and any apps that rely on Apple’s network/security frameworks. These include six intermediates used to issue TLS certificates—each having two variants: one chaining to “emSign Root TLS CA – G3” via “emSign ECC Root CA – G3”, and another cross-signed by Sectigo chaining to “AAA Certificate Services.” Apple also blocked the root “emSign ECC Root CA – G3” on October 23.
Most users won’t need to take any action: these protections are applied automatically and don’t require installing new software. However, administrators, developers, and anyone using command-line tools—such as curl, git, python3, ruby, perl, or openssl—may still be exposed. These tools often refer to the /etc/ssl/cert.pem file for root CAs, which hasn’t yet been updated to block the eMudhra certificates. Until Apple issues a macOS software update fixing that file, manually removing the relevant root CA certificates is recommended for such users.
Apple plans to distribute the updated /etc/ssl/cert.pem file in a future macOS release. In the meantime administrators can follow instructions to remove “emSign ECC Root CA – G3” and/or “AAA Certificate Services” entries from cert.pem, back up the original file, then restore or update it after software updates ensure the fix is built in.
Broader implications & how eMudhra explains it
eMudhra has acknowledged the error, explaining that during a key ceremony on April 30, 2025, a wrap/unwrap script mistakenly produced a second set of weak keys. Faulty labels caused the system to deploy the weak keys instead of the strong ones. Though the flawed keys existed in publicly trusted stores, no deep infrastructure breach or customer data compromise has been found. eMudhra issued alternates via Sectigo, is moving impacted customers to safe certificate hierarchies, and will publish a root cause report after independent review.
Six of the eight intermediates were in the TLS hierarchy, two were used for code signing (which Apple’s frameworks don’t generally trust). The affected keys were tiny—some values were as simple as “4”, no more than 8 bits. Despite audit cycles and a certified hardware setup, the weak keys slipped through until the recent disclosure triggered action.
This incident—while not unprecedented—underscores flaws in key generation processes, risk of weak cryptography, and the importance of timely revocation in public key infrastructure. Developers and system administrators must check their trust stores, update tools and CA bundles, and verify that certificates chaining to the fallen emSign ECC Root CA – G3 are replaced or blocked.
Why it matters: Certificates are foundational to web security—allowing browsers and apps to verify that encryption is legitimate and connections are safe. When an intermediate CA is compromised, it puts the entire ecosystem at risk. Apple’s fast and automatic blocking here helps prevent mass exploitation. What to watch next: the upcoming macOS update that purges trust at the command-line level, eMudhra’s full incident report, and whether any unnoticed impact or misuse shows up after the fact.
