Apple Blocks eMudhra Certificate Flaws, Awaiting macOS Fix
Apple is blocking compromised eMudhra TLS certificates in Safari and Mail following a discovery of weak cryptographic keys. While most users are protected automatically since October 19, macOS command-line tools remain vulnerable until a future update. The issue affects major browsers but lacks evidence of active exploitation, prompting Apple to advise system administrators to manually adjust certificate files in the interim.
Key points
- Security researchers identified weak cryptographic keys in eight intermediate certificates issued by Indian company eMudhra, which were trusted by Safari, Chrome, Edge, and Firefox.
- Apple has automatically blocked these compromised TLS certificates in Safari, Mail, and apps using its networking frameworks since October 19, requiring no user action for most devices.
- macOS command-line tools, frequently used by system administrators, still accept the compromised certificates until Apple releases a specific macOS update containing a fix.
- In the absence of a release date for the macOS update, Apple advises administrators to manually remove root CA certificates from the /etc/ssl/cert.pem file to mitigate risk.
- Although the weak keys could allow attackers to impersonate legitimate websites, there is currently no confirmed evidence that the vulnerabilities were exploited maliciously.
Apple has implemented measures to protect users from a security vulnerability involving compromised certificates from eMudhra, an Indian certificate authority. Security researchers recently discovered that private cryptographic keys associated with eight of eMudhra's intermediate certificates were weaker than expected. These certificates are widely trusted across major web browsers, including Safari, Chrome, Edge, and Firefox, meaning the flaw could theoretically allow attackers to impersonate legitimate websites and intercept sensitive data. However, current analysis suggests that while the risk exists, there is no definitive evidence that the keys have been actively exploited by malicious actors.
To mitigate the threat, Apple began blocking the affected TLS web certificates automatically in Safari, Mail, and applications utilizing its networking and security frameworks on October 19. This automatic blocking ensures that the majority of Apple device owners are protected without needing to install a software update. The company has outlined these changes in a support document, emphasizing that the fix is applied silently in the background for standard user interactions.
A notable exception remains for users of macOS command-line tools, such as system administrators. These tools can still accept the compromised certificates until Apple releases a dedicated macOS update that includes the necessary fixes. Since Apple has not yet provided a specific release date for this update, it has recommended that administrators manually remove the root CA certificates from the /etc/ssl/cert.pem file. This temporary manual adjustment ensures that command-line environments remain secure while the broader macOS update is prepared.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
