Apple Blocks Compromised eMudhra Certificates, macOS Fix Coming

Apple has been blocking compromised TLS web certificates issued by Indian certificate authority eMudhra since October 19, according to a company support document. The block applies in Safari, Mail and apps that rely on Apple's networking and security frameworks, and a macOS update with an additional fix is still to come.

What went wrong

Earlier this month, a security researcher found that the private cryptographic keys tied to eight of eMudhra's intermediate certificate authority certificates were weak. Such keys could let attackers impersonate legitimate websites and potentially expose users' sensitive information. There is currently no evidence that the keys were exploited maliciously.

eMudhra's certificates were trusted by all major browsers, including Safari, Chrome, Edge and Firefox. Apple and the companies behind the other browsers have since acted to protect users.

What Apple users need to do

For most people, nothing. Apple says the certificates are blocked automatically and no software update is required, so typical iPhone, iPad and Mac owners are already covered.

There is one exception. Some macOS command-line tools, which system administrators often use, can still accept the compromised certificates until Apple ships a fix. Apple says affected users can remove the root CA certificates from the /etc/ssl/cert.pem file in the meantime.

What comes next

Apple plans to release a macOS update that changes the /etc/ssl/cert.pem file by default, removing the need for the manual step. The company has not given a release date. Administrators who depend on command-line tooling for connections to external servers should consider applying the workaround until then.