---
title: "Apple confirms macOS update to close eMudhra certificate gap in curl and git"
description: "Apple's new support article confirms a macOS fix for command-line tools and adds a 23 October block on another emSign root."
url: https://mactoreality.com/apple-blocks-compromised-emudhra-certificates-plans-macos-fix-for-command-line-tools
published: 2026-10-26T06:14:26Z
updated: 2026-10-26T06:14:26Z
author: "Mac to Reality Newsdesk"
category: News
tags: ["Privacy & security","Software"]
publisher: Mac to Reality
ai_assisted: true
apple_heat_impact: 1
---

# Apple confirms macOS update to close eMudhra certificate gap in curl and git

*Apple's new support article confirms a macOS fix for command-line tools and adds a 23 October block on another emSign root.*

**Key points**

- Apple automatically blocked 12 compromised eMudhra TLS certificates on Apple devices on 19 October.
- On 23 October, Apple also blocked the emSign ECC Root CA - G3.
- Apple plans a future macOS update to block these certificates in command-line tools like curl and git, with no release date set.

Apple says a future macOS update will extend its block on compromised eMudhra certificates to command-line tools such as curl and git, according to a new [Apple support article](https://support.apple.com/en-us/149555). The 12 affected TLS certificates have been blocked on Apple devices since 19 October.

Private keys for eight of eMudhra’s intermediate Certificate Authorities were compromised; two issue code-signing certificates and six issue TLS certificates. eMudhra and Sectigo have revoked the affected certificates, but an attacker with the keys could have created valid certificates for any website.

The six TLS CAs each have two certificates (one from the emSign Root TLS CA – G3 and one cross-signed by Sectigo), for a total of 12 certificates. Apple began automatically blocking these on all devices on 19 October via a certificate configuration update that requires no software update. On 23 October, Apple also blocked the emSign ECC Root CA – G3.

The block protects Safari, Mail, and apps using Apple’s standard networking and security frameworks. It does not cover command-line tools that rely on /etc/ssl/cert.pem, including curl, git, python3, ruby, perl and openssl. As [we noted earlier](https://mactoreality.com/apple-blocks-eight-weak-web-certificates-macs-may-still-trust-them), that left a gap. Apple says a future macOS software update will extend the block to those tools, but has not given a release date.

Until then, administrators can manually remove the relevant root CA certificates from /etc/ssl/cert.pem. Other users need take no action.

A security researcher discovered the weak private keys earlier this month. There is no evidence the compromised keys were exploited maliciously.

## Sources

- [Apple Support: Apple Support report](https://support.apple.com/en-us/149555)
- [MacRumors: Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix](https://www.macrumors.com/2026/10/25/apple-blocks-compromised-emudhra-certificates/)

*This report was written by the Mac to Reality newsdesk with AI assistance from the sources listed above, under the editorial policy at https://mactoreality.com/editorial-policy.*