Apple blocks cracked eMudhra certificates, except in Mac TerminalApple blocks cracked eMudhra certificates, except in Mac Terminal

Apple has blocked eight web certificates from the Indian certificate authority eMudhra on its devices since 19 October 2026, after a researcher showed their secret keys could be guessed in 256 tries.

Anyone holding those keys could have made a certificate for any website, a bank or apple.com, and a browser would have shown the padlock. iPhones, iPads and Safari are covered by Apple's block. The gap is on the Mac, in the command-line tools that scripts and developers use.

What went wrong at eMudhra

A website certificate is how a browser knows a site is genuine. Certificate authorities sign them, usually through intermediate certificates, which work as the authority's everyday signing stamps. Whoever holds an intermediate's private key can sign as the authority.

Mozilla's incident report found that all eight keys were whole numbers below 256, where a sound key of that type is a number more than 100 digits long. Mozilla wrote that "the impact of this incident could not be higher". Six of the certificates sign websites and two sign software.

eMudhra, a Bengaluru company and one of India's 14 licensed certifying authorities according to MediaNama, blames a script error at an April 2025 key ceremony that produced a second, weaker set of keys. "There were human errors in multiple steps of the process," it told Mozilla.

It revoked all eight on 18 October and says it found no sign they were abused.

How quickly Apple moved

Mozilla's bug sets out the timeline. The researcher, named there only as Wayne, emailed Apple, Google, Microsoft, Mozilla and eMudhra at 18:05 UTC on 17 October. Apple confirmed the finding three hours later, at 21:05 UTC, and asked for proof covering Sectigo's cross-signed copies of the same certificates.

Firefox had the block in place by 22:59 UTC that evening through OneCRL, its revocation list, Mozilla's blog says. Apple's block followed on 19 October, according to the incident tracker kept by Mozilla cryptography engineer Dennis Jackson, which says Apple delivered it through its revocation system rather than a software update.

Is my Mac affected?

macOS itself blocks the eight certificates, Jackson's tracker says, so Safari and apps that use Apple's own checks are protected.

The exceptions are the tools built into macOS for Terminal: curl, git, python3, perl, ruby and openssl. They read a fixed list of trusted roots in /etc/ssl/cert.pem, never ask whether a certificate was revoked, and that file has not been updated. The built-in pip3 uses its own outdated copy of the roots instead.

9to5Mac's account goes further, saying any Mac that has accepted one of the certificates will keep accepting it. The tracker, the primary source, draws the line at those command-line tools, and we follow it.

We read Apple's published root store page on 21 October. Dated 17 December 2025, it still lists both roots the certificates chain to, emSign ECC Root CA - G3 and AAA Certificate Services. So Apple's fix is a revocation, not a removed root, and a tool that only reads the root list cannot see it.

What we would do

• On an iPhone or iPad, nothing. The block needs no update and no setting.
• On a Mac where you never open Terminal, nothing either. Safari and apps that use Apple's own checks already reject the certificates.
• If you run scripts, git or Python on a Mac, open https://dv-g3b-emudhra.we-have-a-problem.com/ with curl in Terminal. Jackson set it up as a test: an error means you are protected, a page means you are not.

Our view: the risk for Terminal users is real but narrow. An attacker would need to sit on your network, on hotel Wi-Fi for example, and forge a certificate for a site your script talks to.

Jackson's tracker gives a manual fix that edits the system file with administrator rights; we would only take it after backing the file up, and otherwise avoid running sensitive scripts on public networks.

It is the second certificate authority story this autumn to land on Mac software rather than the iPhone, after we reported on Apple's original Developer ID certificate authority expiring on 1 February 2027. The next macOS security update is the one to watch: its notes should say whether /etc/ssl/cert.pem has been fixed, and Apple's next root store list whether emSign's root stays.