---
title: "Macs block the weak eMudhra certificates, but built-in curl and git still trust them"
description: "The certificates' private keys could be recovered from just 256 possibilities. macOS itself is protected; its Terminal tools are not yet."
url: https://mactoreality.com/apple-blocks-eight-weak-web-certificates-macs-may-still-trust-them
published: 2026-10-21T15:16:19Z
updated: 2026-10-21T15:16:19Z
author: "Mac to Reality Newsdesk"
category: Rumours
tags: ["Mac","Privacy & security"]
publisher: Mac to Reality
ai_assisted: true
apple_heat_impact: -1
---

# Macs block the weak eMudhra certificates, but built-in curl and git still trust them

*The certificates' private keys could be recovered from just 256 possibilities. macOS itself is protected; its Terminal tools are not yet.*

**Key points**

- Eight eMudhra intermediate certificates had private keys smaller than 256, so anyone could recover them almost instantly.
- Firefox and Chrome blocked them on 17 October, Apple on 19 October and Microsoft on 20 October; eMudhra has revoked them.
- macOS itself rejects them, but built-in curl, git, python3 and other tools still trust them via an outdated /etc/ssl/cert.pem.

Apple has blocked eight compromised intermediate web certificates on its devices since 19 October, but several command-line tools built into macOS still trust them, according to the incident advisory published by Mozilla cryptography engineer Dennis Jackson.

The certificates were created by certificate authority eMudhra in April 2025. A flaw in its key generation meant all eight P-384 private keys were numbers smaller than 256, so anyone could recover them almost instantly, Jackson wrote in Mozilla’s incident report. Six of them can vouch for websites and chain to roots trusted by Apple, Google, Microsoft and Mozilla, so anyone holding the keys could have impersonated any site.

A researcher known as Wayne reported the flaw on 17 October. Firefox and Chrome blocked the certificates the same day, Apple followed on 19 October and Microsoft on 20 October, and eMudhra has revoked all eight.

## The gap is in Terminal

macOS itself rejects the certificates. But the built-in curl, git, python3, perl, ruby and openssl check certificates against the file /etc/ssl/cert.pem without looking at revocation information, and that file has not been updated. The built-in pip3 uses its own, older copy of the root certificates. Jackson’s advisory lists commands that remove the affected roots, plus test addresses to check whether a tool still trusts them.

There are no certificate transparency log entries for the eight intermediates, which means Safari, Chrome, Firefox and Edge could not have been attacked, the advisory says. Whether anyone used the keys against other software is not known, and Apple has not said when a macOS update will refresh the file. 9to5Mac also reported the macOS warning.

## Sources

- [Mozilla (Dennis Jackson): eMudhra Intermediate CA Compromise](https://emudhra.we-have-a-problem.com/)
- [Mozilla Bugzilla: eMudhra: Private key compromise of Intermediate Certificates](https://bugzilla.mozilla.org/show_bug.cgi?id=2083449)
- [9to5Mac: Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains](https://9to5mac.com/2026/10/21/apple-blocks-web-certificates-that-could-be-used-by-scammers-but-mac-vulnerability-remains/)

*This report was written by the Mac to Reality newsdesk with AI assistance from the sources listed above, under the editorial policy at https://mactoreality.com/editorial-policy.*