Follow Up--Apple Says a Future macOS Update Will Fix /etc/ssl/cert.pem for the eMudhra Certificates, Has Blocked the emSign ECC Root CA - G3 Since October 23, and Posted Four Terminal Commands for Mac Administrators Who Will Not Wait

2026October 26, 2026Macs Only!Security
A starlight MacBook Air, open and seen straight on against a white background, its screen showing Adobe Photoshop 2026 with a magazine page: the word FORM in large yellow serif capitals over a hummingbird silhouette, with a green branch and a blue flower below.
Photo: Apple · A starlight MacBook Air, open and seen straight on against a white background, its screen showing Adobe Photoshop 2026 with a magazine page: the word FORM in large yellow serif capitals over a hummingbird silhouette, with a green branch and a blue flower below.

Apple says the Mac's /etc/ssl/cert.pem file, which lets the built-in curl and git keep trusting the eight cracked eMudhra certificates, "will be updated in a future macOS update," and until then it gives four Terminal commands of its own for editing the file. Apple's support document on the compromised eMudhra intermediate CAs is dated October 23, and MacRumors reported it on October 25. It confirms the gap our October 22 warning described from Dennis Jackson's incident page, when Apple had published nothing about the block.

What Apple says it blocked, and when

Apple's document says the private keys of eight intermediate CAs operated by eMudhra were compromised: two issue code signing certificates, "which Apple's frameworks don't trust," and "the other six issue TLS certificates." Each of the six has two certificates, one chaining to emSign ECC Root CA - G3 and one, cross-signed by Sectigo, chaining to AAA Certificate Services, for 12 in all. "On 19 October 2026, Apple began blocking these 12 certificates on Apple devices," and "On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3," a root that Apple's root certificate list for macOS 26 and iOS 26 still carries as trusted. The block reaches Safari, Mail and apps that use Apple's networking and security frameworks, needs no software update, and Apple "is making additional updates to this block, which will also be delivered automatically."

Apple puts the Terminal gap in writing

Under "Do I need to edit /etc/ssl/cert.pem?" Apple says most users do not. "On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem." "For certificates that chain to a root CA certificate in this file, these tools don't check Apple's block or whether the certificate has been revoked." "This file will be updated in a future macOS update." MacRumors notes that Apple "has not provided a release date," and as of October 26 Apple's security releases page lists nothing newer than iOS 27.1 for the iPhone Duo on October 23. The next macOS in the pipeline is 27.2, whose release candidate went to developers on October 19 according to MacRumors' report; whether it carries the new file, Apple does not say. Jackson's incident page, as read on October 26, records that "Apple has stated it will update that file in a future macOS update," and adds that the built-in pip3, and the pip in virtual environments created from the built-in python3, "use their own outdated copy of the roots instead," so editing cert.pem does not reach them.

What to do now

Apple's steps, under "Remove root CA certificates from /etc/ssl/cert.pem," are four commands in Terminal:

  1. Back up the file. Apple's command is [ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig.
  2. Remove emSign ECC Root CA - G3. Apple's command writes a copy of the file without that root to a temporary file with awk, checks that the copy is not empty, and installs it over the original with sudo install; Apple says it "shows nothing when it succeeds."
  3. Optionally remove AAA Certificate Services with the same command. Apple says removing the emSign root alone "doesn't block the six certificates that Sectigo cross-signed," because the tools can still verify them through AAA Certificate Services, and warns that afterward "tools that use only this file might not be able to verify some websites" whose certificates chain to that root through unaffected intermediates.
  4. Check the result with openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services', which prints nothing if both roots are gone.

Apple warns that "A macOS software update can replace /etc/ssl/cert.pem with Apple's version," so the edit may need repeating after any update that arrives before the one with the fix. We have not run Apple's commands ourselves.

Then and now

On October 26, 2006, our note on Intego's Inqtana.d Bluetooth exploit memo passed on Intego's line that "Users with updated Mac OS X systems will already have installed a security update that protects against this vulnerability," and Bill Fox added, "So be sure to apply all Mac OS X security updates issued by Apple." Before that, our April 14, 2003 note recorded Apple applying the OpenSSL team's PKCS #1 padding patch to Mac OS X. The Mac still ships an openssl command, and the fix for it still comes as a software update; what is new is that the browser's fix arrived without one, and that Apple's account of it came four days later. The macOS update has no date, but a numbered Apple page with a backup step beats a volunteer's awk script, and we are glad to have it. [Macs Only!]

Sources

  1. Apple Support, “About the compromised eMudhra intermediate CAs - Apple Support” accessed Oct 26, 2026Published October 23, 2026; "Since 19 October 2026, Apple has been blocking the certificates of the compromised eMudhra intermediate Certification Authorities (CAs) that issue TLS certificates, and is making additional updates to this block"; most users need not act because Safari, Mail and apps that use Apple's networking and security frameworks block the certificates automatically; "Updates to certificate configuration data are sent to devices automatically and as needed, so you don't need to install a software update to get this change"; "The private keys of eight intermediate CAs operated by eMudhra were compromised"; "Two of these CAs issue code signing certificates, which Apple's frameworks don't trust"; "The other six issue TLS certificates"; each of the six TLS CAs has two certificates, one issued by emSign Root TLS CA - G3 chaining to emSign ECC Root CA - G3 and one cross-signed by Sectigo chaining to AAA Certificate Services, 12 in total; "On 19 October 2026, Apple began blocking these 12 certificates on Apple devices"; "On 23 October 2026, Apple also began blocking the emSign ECC Root CA - G3"; "Apple is making additional updates to this block, which will also be delivered automatically"; the section "Do I need to edit /etc/ssl/cert.pem?": "Most users don't need to edit /etc/ssl/cert.pem"; "On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem"; "For certificates that chain to a root CA certificate in this file, these tools don't check Apple's block or whether the certificate has been revoked"; "This file will be updated in a future macOS update"; the section "Remove root CA certificates from /etc/ssl/cert.pem" with four steps: the backup command [ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig ("If a backup already exists, this command keeps it"); the awk and sudo install command removing emSign ECC Root CA - G3, which "shows nothing when it succeeds"; the optional command removing AAA Certificate Services, because removing the emSign root "doesn't block the six certificates that Sectigo cross-signed" and the tools "can still verify them through AAA Certificate Services"; "Afterward, tools that use only this file might not be able to verify some websites whose certificates chain to these root CA certificates through intermediate CAs that weren't affected"; the check command openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services', which "lists either root CA certificate if it's still in the file" and shows nothing if both were removed; "A macOS software update can replace /etc/ssl/cert.pem with Apple's version"; accessed October 26, 2026.
  2. MacRumors, “Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix - MacRumors” accessed Oct 26, 2026Joe Rossignol, Sunday October 25, 2026, 4:07 pm PDT: "In a support document, Apple said it has been blocking eMudhra's compromised TLS web certificates since October 19 in Safari, Mail, and apps that use Apple's networking and security frameworks"; "Apple has not provided a release date for the macOS update that will include the necessary changes to the /etc/ssl/cert.pem file by default"; accessed October 26, 2026.
  3. Dennis Jackson, “eMudhra Intermediate CA Compromise” accessed Oct 26, 2026The incident page dated 20th October 2026, as read October 26, 2026, in its macOS section: "Apple has stated it will update that file in a future macOS update," linking Apple's support document 149555; "The built-in pip3, and the pip in virtual environments created from the built-in python3, use their own outdated copy of the roots instead".
  4. Apple Support, “Apple security releases - Apple Support” accessed Oct 26, 2026As read on October 26, 2026: the newest entry is iOS 27.1 for iPhone Duo, 23 Oct 2026, followed by the 28 Sep 2026 releases (iOS 27.0.1 and iPadOS 27.0.1, iOS 26.7.1 and iPadOS 26.7.1, macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1, watchOS 27.0.1, visionOS 27.0.1); no entry mentions certificates or eMudhra and no macOS entry is dated October 2026.
  5. MacRumors, “Apple Seeds macOS Golden Gate 27.2 Release Candidate to Developers - MacRumors” accessed Oct 26, 2026Juli Clover, Monday October 19, 2026, 10:28 am PDT: Apple seeded the macOS Golden Gate 27.2 release candidate to developers that day; accessed October 26, 2026.
  6. Apple Support, “List of available root certificates in iOS 26, iPadOS 26, macOS 26, tvOS 26, visionOS 26 and watchOS 26 - Apple Support” accessed Oct 26, 2026Published December 17, 2025; as read October 26, 2026 the trusted-certificates table still carries the rows "emSign ECC Root CA - G3", issued by emSign ECC Root CA - G3, ECDSA, 384 bits, and "AAA Certificate Services", issued by AAA Certificate Services, RSA, 2048 bits.
  7. Apple Newsroom, “Apple introduces the new MacBook Air with M5 - Apple” accessed Oct 26, 2026March 3, 2026: the press picture Apple-MacBook-Air-hero-260303_big.jpg.large.jpg, which Apple captions "MacBook Air with M5 shows an Adobe Photoshop screen."; accessed October 26, 2026.

Then and now

All pairings

In 2006 Intego said Apple's security updates already closed the Inqtana.d Bluetooth hole; in 2026 Apple says its block covers Safari and Mail, and a macOS update will cover curl.

Also on October 26, other years

Every October 26 since 1997

Saw something? Send a tip or a correction

The archive ran on reader tips. What did you see, where, and do you want the credit? Something wrong on this page? Say so and it gets fixed.

Read by the editor. You get a copy by email. Never published without your say.

More in Security · This month in the archive