GoKawiilApple blocks 12 compromised eMudhra TLS certificates across its devices
Apple began automatically blocking 12 compromised intermediate certificates from eMudhra's Certificate Authorities on 19 October 2026 after private keys for eight of the CAs were exposed. Six of the CAs could have issued fraudulent TLS certificates for any website; eMudhra and Sectigo have since revoked the affected certificates. Apple's block covers Safari, Mail and apps using its networking frameworks automatically, though command-line tools like curl and git may still accept the certificates until a future update.
GoKawiil's interpretation of the reporting above, not reported fact.
The compromise of CA private keys is serious because it could let attackers impersonate virtually any website with certificates that browsers would normally trust, undermining the chain of trust the web relies on. Apple's layered response—automatic blocking for most users plus manual remediation steps for developers using Terminal—suggests the company is trying to balance broad protection with minimal disruption while acknowledging some tools remain exposed in the interim.
- Private keys for 8 eMudhra intermediate CAs were compromised, 6 of which issue TLS certificates usable for any site.
- Apple has automatically blocked 12 affected certificates since 19 October 2026 for most apps and services.
- Developers using Terminal tools like curl or git may need to manually remove root CA certificates for full protection.
Source: support.apple.com, 2026-10-28
Published there as: “About the compromised eMudhra intermediate CAs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.