Apple is taking a firmer stand on certificate security in macOS with the developer beta release of version 27.3, which shuts out a batch of wildly insecure certificates from the dating back to April 2025. These certificates, issued by the Indian certificate authority eMudhra, were found to have abysmally weak cryptographic keys — one even used the digit “4” alone. They’ve already been blocked in iOS, iPadOS, and by browsers like Firefox and Chrome, but Macs were still vulnerable due to certificate revocation rules.
What was wrong with these certificates?
These root certificates were generated using extremely short private keys, far below any reasonable cryptographic standard. While most were never deployed in production, their very presence in trusted root stores left macOS systems exposed. Previous blocking measures on Apple’s mobile platforms and by browser makers prevented new usages, but on macOS, tools like curl don’t always check certificate revocation status — meaning that an already trusted bad certificate could continue to be trusted indefinitely.
How macOS 27.3 fixes the problem
With the new developer beta of macOS 27.3, Apple is eliminating the risk by fully disabling those root certificates — even those manually trusted in the past. That means these defective eMudhra roots will no longer work under any circumstance. Apple also notes that this update is expected in the public release in December, and may also release a smaller patch (version 27.2.1) beforehand to address the issue immediately.
For admins and power users who need a quicker fix, Apple has published instructions for manually removing root certificates without updating the OS. These steps are meant to bridge the gap before the update arrives.
This follows moves from Firefox, Chrome, Microsoft, and Mozilla, who blocked the eight eMudhra certificates in mid-October. Six of them were signed for TLS and included in major root stores; two for code signing and trusted by Microsoft. Thankfully, no evidence yet shows any of the compromised certificates were ever used in attacks.
Why this matters: macOS devices had been the weak link due to revocation behavior. Even though Apple had pushed protections on other platforms, macOS continued to accept the certificates once trusted. This fix finally brings macOS in line with the rest of Apple’s ecosystem.
Analysis: Apple’s decision to block root certificates retroactively — ones already trusted by users — marks a shift in their security posture. It underscores an understanding that trust must be constantly reassessed, especially in root infrastructures that form the backbone of internet security. As threats evolve, so too must the systems we rely on: this update proves that critical security infrastructure can’t rely on legacy behaviors or dormant trust. Going forward, users should expect more aggressive cleanup around cryptographic trust, and better support for revocation and certificate hygiene in both macOS and across all platforms.”
