Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix
A security researcher uncovered that the private keys for eight of eMudhra’s intermediate certificate‑authority certificates were generated with insufficient entropy, making them mathematically weak. If an attacker had derived those keys, they could have forged TLS certificates and masqueraded as any site that trusted eMudhra’s chain, exposing users to credential theft or man‑in‑the‑middle attacks. Apple responded by adding the affected certificates to its built‑in blocklist on October 19, which takes effect instantly for Safari, Mail and any app that relies on Apple’s networking frameworks—no OS patch required. However, the block does not extend to the OpenSSL‑style trust store used by macOS command‑line utilities, meaning sysadmins who compile or run scripts that validate TLS handshakes could still accept the compromised certificates until Apple ships an update that amends the /etc/ssl/cert.pem bundle. In the interim, Apple advises administrators to edit that file manually to excise the offending roots.
The episode illustrates how modern browsers and operating systems are moving toward “push‑only” revocation: they can invalidate bad certificates remotely without waiting for a user‑initiated update. Chrome, Edge and Firefox have already removed eMudhra’s certificates from their trust stores, and Apple’s automatic block mirrors that industry‑wide response. Yet the persistence of the vulnerability in macOS’s low‑level tooling shows a split between high‑level UI browsers, which receive rapid, cloud‑driven mitigations, and legacy command‑line stacks that still depend on static trust anchors. This dichotomy is a reminder that supply‑chain hardening must address every layer of the stack, not just the consumer‑facing browsers.
Looking ahead, enterprises that rely on macOS automation, CI pipelines or remote management scripts should audit their trust stores now and apply the recommended manual removal of the compromised roots. The timing of Apple’s forthcoming macOS update—still undisclosed—will be a key signal of how aggressively the company patches deep‑system components. If the fix is delayed, organizations may face compliance gaps, especially in regulated sectors that mandate up‑to‑date TLS validation. Monitoring Apple’s security bulletins and the release notes of the next macOS point release will be essential to confirm that the block is baked into the default cert bundle.
Key Takeaways
Apple’s automatic block protects Safari and framework‑based apps without requiring a macOS update.
macOS command‑line tools still trust the compromised eMudhra certificates until a system patch or manual edit of /etc/ssl/cert.pem.
The incident underscores the need for uniform revocation across both UI browsers and low‑level utilities.
Enterprises should verify their macOS automation environments now and plan for the pending OS update to avoid compliance exposure.
About the Source
This analysis is based on reporting by MAC Rumors. Here is a short excerpt for context:
Earlier this month, a security researcher discovered that private cryptographic keys associated with eight of Indian company eMudhra's intermediate certificate authority (CA) certificates were weak. The compromised keys could have allowed attackers to impersonate legitimate websites, potentially putting users' sensitive information at risk. However, there is currently no evidence that the keys were exploited maliciously. eMudhra's certificates were widely trusted by all major web browsers, including Safari, Chrome, Edge, and Firefox, but Apple and the other companies behind those browsers have since taken action to protect users. support document, Apple said it has been blocking eMudhra's compromised TLS web certificates since October 19 in Safari, Mail, and apps that use Apple's networking and security frameworks. The certificates are blocked automatically with no software update required, so most Apple device owners do not need to take any action. There is one exception. Apple said those who use macOS command-line tools, such as system administrators, should be aware that some of those tools can still accept the compromised certificates until Apple releases a macOS update with a fix. In the meantime, Apple said those who use command-line tools can remove root CA certificates from the /etc/ssl/cert.pem file. Apple has not provided a release date for the macOS update that will include the necessary changes to the /etc/ssl/cert.pem file by default. Apple's support document. Tags: macOS Security, Safari This article, "Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix" first appeared on MacRumors.com Discuss this article in our forumsRead the original at MAC Rumors
