Apple says a future macOS update will extend its block on compromised eMudhra certificates to command-line tools such as curl and git, according to a new Apple support article. The 12 affected TLS certificates have been blocked on Apple devices since 19 October.
Private keys for eight of eMudhra’s intermediate Certificate Authorities were compromised; two issue code-signing certificates and six issue TLS certificates. eMudhra and Sectigo have revoked the affected certificates, but an attacker with the keys could have created valid certificates for any website.
The six TLS CAs each have two certificates (one from the emSign Root TLS CA – G3 and one cross-signed by Sectigo), for a total of 12 certificates. Apple began automatically blocking these on all devices on 19 October via a certificate configuration update that requires no software update. On 23 October, Apple also blocked the emSign ECC Root CA – G3.
The block protects Safari, Mail, and apps using Apple’s standard networking and security frameworks. It does not cover command-line tools that rely on /etc/ssl/cert.pem, including curl, git, python3, ruby, perl and openssl. As we noted earlier, that left a gap. Apple says a future macOS software update will extend the block to those tools, but has not given a release date.
Until then, administrators can manually remove the relevant root CA certificates from /etc/ssl/cert.pem. Other users need take no action.
A security researcher discovered the weak private keys earlier this month. There is no evidence the compromised keys were exploited maliciously.