Cupertino: Apple is preparing a future macOS software update to strengthen protection for certain command-line tools following a cybersecurity incident involving weak cryptographic keys linked to Indian digital trust company eMudhra.

The company has already begun blocking the affected digital certificates across its devices. However, some command-line utilities used by developers and system administrators may continue to accept certificates associated with the compromised certificate authorities until Apple updates the relevant certificate bundle.

Apple confirmed that it started blocking 12 affected TLS certificates on October 19, 2026, and began blocking the emSign ECC Root CA – G3 certificate on October 23. The changes are being delivered automatically, so most Mac users do not need to install a separate update or change their settings to receive the existing protection.

The remaining concern relates to tools such as curl, git, Python and OpenSSL that may rely on a certificate file maintained separately from Apple’s normal certificate-blocking mechanisms.

Apple has said a future software update will address this gap. It has not announced a release date for the update.

Apple blocks affected eMudhra certificates

Apple’s initial response began on October 19, when it started blocking 12 TLS certificates associated with six affected eMudhra intermediate Certificate Authorities (CAs).

Certificate authorities issue digital certificates that help establish whether a website is genuine and whether an encrypted connection can be trusted. Intermediate CAs operate between a root certificate authority and the certificates issued to individual websites.

Apple subsequently began blocking the emSign ECC Root CA – G3 on October 23 as part of its response to the incident.

The existing protection applies automatically to Safari, Mail and applications that use Apple’s networking and security frameworks. Apple distributes certificate-blocking configuration changes automatically, meaning users do not need to download a separate security tool to receive this protection.

The company has also said that additional changes will be included in a future macOS software update to address the way certain command-line tools validate certificates.

For ordinary users who primarily browse the web, send emails and use standard applications, Apple says no manual intervention is necessary.

Why Mac command-line tools need additional attention

The issue is more relevant to developers, engineers and system administrators who regularly use Terminal to access websites, manage repositories, automate tasks or test network connections.

Some command-line tools included with macOS or Apple’s Xcode Command Line Tools rely on the certificate bundle located at /etc/ssl/cert.pem.

According to Apple, tools including curl, git, python3, Ruby, Perl and OpenSSL can use this file to verify website certificates. In certain circumstances, these tools may continue to accept certificates linked to the affected root authorities because they do not check Apple’s certificate-blocking information or certificate revocation status in the same way as Apple’s native frameworks.

This does not mean every Mac or every installation of these tools is vulnerable. The behaviour depends on which certificate store a particular tool uses and how it performs certificate validation.

Some third-party applications maintain their own certificate lists instead of relying on Apple’s system frameworks or /etc/ssl/cert.pem. Apple has advised users of such applications to contact the relevant developers for guidance.

The distinction is important because a certificate can be blocked in one trust store while remaining trusted by a separate application or utility that has not received the corresponding change.

What can developers and system administrators do?

Apple says administrators who do not want to wait for the upcoming software update can take an optional mitigation step by removing the relevant root CA certificates from /etc/ssl/cert.pem.

However, this is not a routine step recommended for every Mac owner. Apple warns that modifying the file affects all tools that rely on it and could prevent them from verifying some legitimate websites whose certificate chains pass through the affected root authorities but are otherwise unaffected.

The company also notes that a macOS software update may replace the file with Apple’s version. Until the update containing the permanent changes is installed, administrators who have manually modified the file may need to check whether the changes have been overwritten.

Once Apple releases the update that incorporates the required certificate changes, users of the affected built-in command-line tools will not need to continue making the manual modifications.

For organisations that manage large numbers of Macs, the incident highlights the importance of checking which trust stores are used by development environments, automated processes and security-sensitive applications.

Administrators should follow Apple’s official guidance before modifying system certificate files, particularly on machines used for production systems or business-critical services.

What happened in the eMudhra cybersecurity incident?

The security issue emerged after an independent researcher reported on October 17 that private cryptographic keys associated with eight eMudhra intermediate certificate authorities were weak.

According to eMudhra’s account, a flaw during a key-generation procedure produced weak keys alongside the intended keys. The weak keys were subsequently published in the company’s public trust infrastructure, creating the possibility that someone could recover them and use them to generate fraudulent certificates.

Such certificates could potentially be used to impersonate legitimate websites or services on systems that continued to trust the affected authorities. This is a serious concern because digital certificates underpin the authentication process used to establish secure HTTPS connections.

eMudhra said it revoked all eight affected intermediate certificates on October 18 and began working with browser and operating-system vendors to contain the issue. The company has said that none of the affected intermediates had issued end-entity certificates and that it had found no evidence of a data breach or malicious exploitation. Its investigation into the underlying cause remains ongoing.

The incident also exposed a weakness in the certificate-generation process rather than indicating that every eMudhra service or certificate was compromised.

Google, Mozilla and other technology companies respond

Apple is not the only technology company that has acted on the incident.

Google said it blocked the affected intermediate certificate public keys in Chrome through a Certificate Revocation List Set update on October 17. Google also announced plans to remove the emSign ECC Root CA – G3 from the Chrome Root Store, a change that could affect legitimate websites whose certificates rely on that root and therefore require migration to another trusted certificate hierarchy.

Mozilla also blocked affected certificates through Firefox’s OneCRL mechanism and issued updates for certain Firefox versions and configurations. Other software vendors and certificate-store maintainers have taken steps to remove or distrust the affected certificates.

These responses illustrate why the incident requires coordinated action. Different browsers, operating systems and applications maintain or consult different certificate stores, and a change in one trust system does not automatically guarantee that every other system has applied the same protection.

The risk is therefore not limited to conventional web browsers. Applications, development tools and devices that rely on separate or outdated certificate stores may need their own updates or configuration changes.

India’s digital signature and eSign services remain unaffected

The incident has also drawn attention in India because eMudhra operates in the country’s digital trust and cybersecurity sector.

However, India’s Computer Emergency Response Team (CERT-In) has clarified that its advisory concerns eMudhra’s international public-trust infrastructure used for website certificates. The company’s domestic Digital Signature Certificate and eSign infrastructure, regulated under a separate framework, was not affected by the reported incident, according to the advisory.

This distinction matters because website TLS certificates and digital signature services serve different purposes and may operate on separate technical infrastructure.

The incident has nevertheless raised broader questions about cryptographic key generation, independent audits and the safeguards required to maintain confidence in digital certificate systems.

What Mac users should know

For most Mac users, Apple’s automatic blocking measures provide protection without requiring any immediate action. Users who do not use Terminal-based tools as part of their workflow can continue using their devices normally while keeping their software updated.

Developers and system administrators, however, should review Apple’s advisory and determine whether their tools rely on /etc/ssl/cert.pem or use separate certificate stores. Any manual changes should be made cautiously, as they may affect legitimate certificate validation as well as the affected trust chains.

Apple has not yet announced when the macOS update addressing the command-line certificate bundle will arrive.

The incident serves as a reminder that browser security and system-wide certificate validation do not always operate identically. While Apple and other technology companies have moved to block the compromised eMudhra certificates, ensuring consistent protection across different applications and tools remains an important part of the response.