eMudhra Distrust: macOS Command-Line Tools Still Trust the Compromised CAs, Apple Says

Apple has confirmed that command-line tools on macOS, including curl, git and python3, "can still accept these certificates until a future software update": the certificates issued under eMudhra intermediate authorities whose private keys leaked. Safari and apps built on Apple's networking frameworks are already protected. Apple's note, dated 29 October, followed a 28 October post by researcher Dennis Jackson showing that macOS 27.2 hadn't closed the gap.

Where eMudhra stands

The Indian certificate authority has decided "to voluntarily withdraw from the global SSL/TLS certificate business", and told Mozilla that about 30,000 certificates must move to other providers. India's IT ministry says Indian digital signature certificates and eSign are unaffected.

macOS

Apple says these tools read /etc/ssl/cert.pem, a file its block doesn't reach. Apple's workaround is to back up that file and remove emSign ECC Root CA - G3 from it, then repeat the edit after every macOS update. Jackson publishes a test: if git ls-remote https://git-emudhra.we-have-a-problem.com/check.git fails with a certificate error, the machine rejects the compromised chain.

Windows

Microsoft removed seven certificates from Windows on 26 October and from Edge on 27 October, and says it's evaluating eMudhra's remaining roots separately. Machines that don't take automatic trust updates need the out-of-band packages KB5134133 for Windows 11 and KB5134125 for Windows 10.

Cisco

Cisco's advisory, at version 1.4 since 28 October, says it isn't aware of malicious use.

Its product fixes run from Trusted Root 2.8 for Email Security gateways, pulled automatically or with updatenow, to IOS XR 26.4.1 by 30 November and ISE 3.5 Patch 5 in December; IOS XE, Nexus and several other lines are still under investigation.

Websites and code

Google says any site whose certificate chains to emSign ECC Root CA - G3 "must immediately acquire and install a new TLS certificate from another PKI hierarchy". Go programs need Go 1.27.3 or 1.26.10, and Cisco Talos advises checking appliances and build runners that keep their own trust stores.