The recent cybersecurity incident involving eMudhra has prompted Apple to take significant measures to protect its users. The company has begun blocking certain compromised certificates that are linked to eMudhra, a digital trust and cybersecurity firm based in India. This action aims to enhance security across its devices, particularly for those who utilise command-line tools on Mac systems.

On October 19, 2026, Apple confirmed that it started blocking twelve TLS certificates associated with six of eMudhra’s compromised intermediate Certificate Authorities (CAs). These certificates are essential for verifying the authenticity of websites. Additionally, the emSign ECC Root CA – G3 was blocked on October 23, further reinforcing Apple’s security measures.

Apple’s automatic protection is already in effect for applications like Safari and Mail, which utilise the company’s networking and security frameworks to block the affected certificates. Users do not need to manually update or adjust any settings to benefit from this protection, making it a seamless experience for most.

Implications for Command-Line Tool Users

However, the situation is more complex for users who frequently rely on command-line tools such as curl, git, Python, and OpenSSL. These tools verify certificates against a specific file, `/etc/ssl/cert.pem`, which may still accept the compromised certificates due to a difference in how they check for blocked certificates.

Apple has indicated that a forthcoming macOS software update will rectify this issue. In the interim, developers and system administrators who wish to take immediate action can manually remove the relevant root CA certificates from their systems. Apple has cautioned that this step could potentially disrupt the ability of some tools to verify other websites, suggesting that it may not be necessary for the average user.

As of now, Apple has not provided a timeline for when the software update will be released, leaving users in a state of uncertainty regarding the complete resolution of this issue.

Background on eMudhra and the Incident

For context, eMudhra is an Indian company that issues digital certificates, which serve as identity verification for websites. These certificates play a crucial role in helping browsers confirm the authenticity of websites and establish secure, encrypted connections.

The incident emerged when researchers discovered that private keys associated with eight intermediate CAs operated by eMudhra were compromised due to weak cryptographic measures. The vulnerability reportedly allowed for easy recovery of these keys, raising concerns that malicious actors could generate fraudulent certificates for websites they do not control.

Among the affected CAs, six issue TLS certificates that secure connections between browsers and websites, while the remaining two provide code-signing certificates that are not trusted by Apple’s frameworks. In response to the breach, both eMudhra and certificate provider Sectigo have revoked the compromised certificates.

Major technology companies, including Apple, Google, Microsoft, and Mozilla, have taken proactive steps to block the flawed certificates. Furthermore, India’s Ministry of Electronics and Information Technology has initiated an investigation into the matter, with CERT-In issuing an advisory outlining mitigation measures. Although no evidence of malicious exploitation has been found to date, the incident underscores the potential risks associated with vulnerabilities in certificate authorities, which can impact a wide range of users and organisations.

Long or Short, get news the way you like. No ads. No redirections. Download Newspin and Stay Alert, The CSR Journal Mobile app, for fast, crisp, clean updates!

App Store – https://apps.apple.com/in/app/newspin/id6746449540

Google Play Store – https://play.google.com/store/apps/details?id=com.inventifweb.newspin&pcampaignid=web_share