eMudhra effect: Apple to release special update for Mac users to secure command-line tools

Apple has blocked eMudhra digital certificates which may be compromised due to weak cryptographic keys. While most Apple users are already protected, some Mac command-line tools may need extra attention until a software update arrives.

In Short

• Apple is blocking 12 compromised eMudhra TLS certificates
• Safari, Mail and supported apps block the certificates automatically
• Apple is preparing a macOS update to address the issue

The recent eMudhra cybersecurity incident involving weak cryptographic keys has made major tech giants around the world cautious. Apple has also started blocking the affected certificates across its devices; but there remains a small catch, especially for those who use Mac and rely on command-line tools for their work. Some of these tools may continue to accept the compromised certificates until Apple rolls out a software update. So, while most users do not need to worry, developers and system administrators may need to take a few extra steps.

Apple blocks eMudhra certificates

Apple confirmed in a blog post that it began blocking 12 TLS certificates on October 19, 2026. These certificates are linked to six of eMudhra's compromised intermediate Certificate Authorities (CAs), which issue certificates used to verify websites. Apple also started blocking the emSign ECC Root CA - G3 on October 23.

The good news is that this protection works automatically. Safari, Mail and apps that use Apple's networking and security frameworks already block the affected certificates. Users do not need to download a separate update or change any settings to get this protection.

However, things are a little different for people who use Terminal regularly. Some command-line tools, including curl, git, Python and OpenSSL, can check certificates against a file called `/etc/ssl/cert.pem`. These tools may still accept the affected certificates because they do not check Apple's certificate block in the same way.

Apple says a future macOS software update will address this gap. Until then, administrators and developers who want to act sooner can remove the relevant root CA certificates from the file. Apple warns that doing so may affect the ability of some tools to verify other websites, so this step is not necessary for most users. The company has not announced when the update will arrive.

What happened with eMudhra?

For those who are unfamiliar with eMudhra, it is an Indian digital trust and cybersecurity company that issues digital certificates. Think of these certificates as identity cards for websites. They help browsers confirm that a website is genuine and establish a secure, encrypted connection.

It came amid a fierce storm when a few researchers discovered that the private keys linked to eight intermediate CAs operated by eMudhra were compromised because they were weak. The keys were reportedly easy to recover, raising the possibility that someone could use them to create certificates that appeared valid for websites they did not control.

Six of the affected CAs issue TLS certificates, which help secure connections between browsers and websites. The other two issue code-signing certificates, which Apple's frameworks do not trust. eMudhra and certificate provider Sectigo have revoked the affected certificates.

Apple, Google, Microsoft and Mozilla have taken steps to block the flawed certificates. India's Ministry of Electronics and Information Technology has also taken note of the incident and formed a team to investigate, while CERT-In has issued an advisory with mitigation measures.

So far, there is no evidence of malicious exploitation. Still, the incident highlights how a weakness in a certificate authority can create risks far beyond a single company, since browsers and users rely on these certificates to decide which websites they can trust.

- Ends