macOS security update removes compromised eMudhra certificates

Apple released the first macOS 27.3 developer beta on November 4, 2026, and it contains a security fix that removes several compromised web certificates linked to the Indian certificate authority eMudhra. The change deletes the affected certificates from the system‑wide /etc/ssl/cert.pem file, stopping command‑line tools from trusting them. Users who do not rely on Terminal‑based tools are already protected because Safari, Mail and other Apple apps have blocked the certificates since October 19.

What the fix addresses

The security fix targets eight intermediate certificates issued by eMudhra that were found to have weak private keys. A security researcher disclosed that those keys could let an attacker forge TLS certificates and impersonate legitimate websites. While no evidence shows the keys were used maliciously, the possibility of credential theft or man‑in‑the‑middle attacks was enough for Apple to act. By removing the certificates from the global trust file, macOS prevents any software that reads that file, most notably command‑line utilities, from accepting the compromised authorities.

How Apple is handling the compromised certificates

According to MacRumors, Apple began blocking eMudhra’s compromised TLS web certificates on October 19 in Safari, Mail and any app that relies on Apple’s networking and security frameworks. The block works automatically, so most users do not need to download a software update to gain protection. The upcoming macOS 27.2.1 public update is expected to carry the same fix that appears in the 27.3 developer beta, allowing a broader audience to benefit without enrolling in the beta program.

What this means for Mac users

For the average Mac owner, the change is invisible. Browsers, email clients and other everyday apps already refuse to trust the flagged certificates, meaning regular web‑based activity remains safe. The impact is more noticeable for developers, system administrators and power users who run scripts, package managers or other command‑line tools that validate TLS certificates against the /etc/ssl/cert.pem bundle. Those tools would have accepted the compromised eMudhra certificates until the fix was applied, potentially exposing automated workflows to spoofed servers.

Practical steps you can take

• Install the public update: When macOS 27.2.1 becomes available, apply it through System Settings → Software Update.
• Use the beta if you need the fix sooner: Developers comfortable with beta software can download the macOS 27.3 developer beta and install it.
• Manually remove the certificates: If you prefer not to update now, follow Apple’s support document to edit /etc/ssl/cert.pem. The process involves opening the file with a text editor, locating the entries that match the compromised certificate fingerprints (listed in the support article), and deleting those lines.
• Verify removal: After editing, run openssl s_client -connect example.com:443 -CAfile /etc/ssl/cert.pem for a site you trust. The command should complete without errors related to the removed certificates.
• Monitor future releases: Keep an eye on Apple security bulletins for any additional updates related to certificate authorities.

By staying current with macOS updates or following the manual removal steps, you can ensure that both graphical and command‑line applications on your Mac continue to trust only legitimate certificates.

How to stay ahead of similar threats

Apple’s response demonstrates the value of a layered security approach. Even when a vulnerability is discovered in a third‑party certificate authority, Apple can protect users at the application level while delivering a system‑wide fix in a later update. For organizations, this reinforces the need to:

• Maintain regular patch cycles for operating systems and development tools.
• Use multi‑factor authentication for remote access to reduce the impact of a possible certificate compromise.
• Audit the list of trusted root and intermediate CAs in your environment, especially on servers that host internal services.

By combining timely OS updates with good operational hygiene, you can mitigate the risk posed by weak or compromised certificates.

Bottom line: The macOS 27.3 security fix removes eMudhra’s compromised certificates from the system trust store, protecting command‑line tools while most users are already safe through built‑in blocks. Apply the upcoming 27.2.1 update or follow the manual removal guide to stay fully protected.