About the compromised eMudhra intermediate CAs

Since 19 October 2026, Apple has been blocking the certificates of the compromised eMudhra intermediate Certification Authorities (CAs) that issue TLS certificates, and is making additional updates to this block. If you don't use Terminal as part of your workflow, you don't need to do anything. Your Apple devices now automatically block these certificates in Safari, Mail, and apps that use Apple's networking and security frameworks.If you use Terminal as part of your workflow (such as system administrators or developers), you might use command-line tools that can still accept these certificates. Some tools included with macOS or the Xcode Command Line Tools — like curl and git — check certificates against /etc/ssl/cert.pem and can still accept these certificates until a future software update. To stop those tools from accepting them sooner, you can remove root CA certificates from the file. The private keys of eight intermediate CAs operated by eMudhra were compromised. Two of these CAs issue code signing certificates, which Apple's frameworks don't trust. The other six issue TLS certificates. Someone with keys from these six CAs could create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates. Each of the 6 TLS intermediate CAs has two certificates, for 12 in total: A certificate issued by emSign Root TLS CA - G3, which chains to emSign ECC Root CA - G3A certificate cross-signed by Sectigo, which chains to AAA Certificate Services View a list of these 12 certificates On 19 October 2026, Apple began blocking these 12 certificates on Apple devices. Updates to certificate configuration data are sent to devices automatically and as needed, so you don't need to install a software update to get this change. Apple is making additional updates to this block, which will also be delivered automatically. On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3. Apple is making further changes to block these certificates in other places on Mac where software checks certificates, such as the command-line tools included with macOS or the Xcode Command Line Tools that use /etc/ssl/cert.pem. These changes will be available in a future software update, and you won't need to edit any files to get them. Most users don't need to edit /etc/ssl/cert.pem. Safari, Mail, and apps that use Apple's networking and security frameworks don't use this file, and your Apple devices block these certificates …