About the compromised eMudhra intermediate CAs

Apple is blocking the compromised certificates automatically. Mac administrators can take optional steps for some command-line tools.

Since 19 October 2026, Apple has been blocking the certificates of the compromised eMudhra intermediate Certification Authorities (CAs) that issue TLS certificates, and is making additional updates to this block.

• If you don't use Terminal as part of your workflow, you don't need to do anything. Your Apple devices now automatically block these certificates in Safari, Mail, and apps that use Apple's networking and security frameworks.

• If you use Terminal as part of your workflow (such as system administrators or developers), you might use command-line tools that can still accept these certificates. Some tools included with macOS or the Xcode Command Line Tools — like curl and git — check certificates against /etc/ssl/cert.pem and can still accept these certificates until a future software update. To stop those tools from accepting them sooner, you can remove root CA certificates from the file.

What happened

The private keys of eight intermediate CAs operated by eMudhra were compromised. Two of these CAs issue code signing certificates, which Apple's frameworks don't trust. The other six issue TLS certificates. Someone with keys from these six CAs could create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates.

Each of the 6 TLS intermediate CAs has two certificates, for 12 in total:

• A certificate issued by emSign Root TLS CA - G3, which chains to emSign ECC Root CA - G3

• A certificate cross-signed by Sectigo, which chains to AAA Certificate Services

View a list of these 12 certificates

What Apple is doing

On 19 October 2026, Apple began blocking these 12 certificates on Apple devices. Updates to certificate configuration data are sent to devices automatically and as needed, so you don't need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3.

Apple is making further changes to block these certificates in other places on Mac where software checks certificates, such as the command-line tools included with macOS or the Xcode Command Line Tools that use /etc/ssl/cert.pem. These changes will be available in a future software update, and you won't need to edit any files to get them.

Do I need to edit /etc/ssl/cert.pem?

Most users don't need to edit /etc/ssl/cert.pem. Safari, Mail, and apps that use Apple's networking and security frameworks don't use this file, and your Apple devices block these certificates in them automatically.

On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don't check Apple's block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don't want to wait for the update, you can remove root CA certificates from the file.

Remove root CA certificates from /etc/ssl/cert.pem

Rather than wait for the upcoming software update, administrators can choose to remove the root CA certificates to which the blocked certificates chain from /etc/ssl/cert.pem.

• These steps affect every tool that uses /etc/ssl/cert.pem. Afterward, tools that use only this file might not be able to verify some websites whose certificates chain to these root CA certificates through intermediate CAs that weren't affected.

• A macOS software update can replace /etc/ssl/cert.pem with Apple's version. Until you install the software update that includes Apple's changes, run the command in step 4 after each software update. If it lists a root CA certificate that you removed, the update replaced the file. Delete the old backup using sudo rm /etc/ssl/cert.pem.orig, then repeat these steps. After you install the update that includes Apple's changes, you don't need to repeat these steps for the command-line tools included with macOS or the Xcode Command Line Tools.

• You need an administrator account, or you can deploy the commands with your device management solution. Copy each command exactly as written. Learn what to do if you get an alert about possible malware when pasting the command into Terminal.

To remove root CA certificates from /etc/ssl/cert.pem:

1. Back up the file. If a backup already exists, this command keeps it:

   • [ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig

2. Remove emSign ECC Root CA - G3. This command makes a copy of the file without emSign ECC Root CA - G3, checks that the copy isn't empty, and replaces the original. It shows nothing when it succeeds:

   • t=$(mktemp) && awk -v s='=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"

3. Optional: Removing emSign ECC Root CA - G3 doesn't block the six certificates that Sectigo cross-signed, because these tools can still verify them through AAA Certificate Services. To stop these tools from accepting those six certificates through the file until you install Apple's software update, you can also remove AAA Certificate Services. This command works the same way as the one in step 2:

   • t=$(mktemp) && awk -v s='=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"

4. Check the result. This command lists either root CA certificate if it's still in the file. If you removed both, it shows nothing. If the command shows an error, restore the backup from step 1.

   • openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services'.

Blocked certificates