> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Mac Terminal Tools Still Trust the Bad eMudhra Certs
- URL: https://blog.harshkohli.com/mac-terminal-emudhra-certificates/
- Published: 2026-10-26T01:01:05.000Z
- Updated: 2026-10-26T01:01:05.000Z
- Description: Apple now blocks the leaked eMudhra certificates in Safari and apps, but curl, git and python3 on Mac still trust them. Here's the fix for admins.
- Author: Harsh Kohli
- Tags: Tech News, Software

Last week I wrote about the [eMudhra certificate mess](https://blog.harshkohli.com/emudhra-weak-certificate-keys/), where eight intermediate certificates had private keys so weak anyone could recover them. Browsers blocked them fast. Now Apple has said where it stands, and there's one gap Mac users who live in Terminal should know about. I saw it first in [MacRumors' post on X](https://x.com/MacRumors/status/2114494115698327797?ref=blog.harshkohli.com) and then read Apple's own support note.

## What happened

In a [support document dated October 23](https://support.apple.com/en-us/149555?ref=blog.harshkohli.com), Apple says it started blocking the bad certificates on October 19\. Six of the eight eMudhra intermediates issue TLS certificates (the other two do code signing, which Apple's frameworks don't trust anyway). Each of those six exists twice: once issued by emSign Root TLS CA - G3, which chains up to the emSign ECC Root CA - G3 root, and once cross-signed by Sectigo under AAA Certificate Services. So Apple's block list has 12 entries. On October 23 it also started blocking the emSign ECC Root CA - G3 root itself.

This block lives in certificate data Apple pushes to devices on its own. You don't need a software update, and Safari, Mail and any app that uses Apple's networking frameworks are already covered on iPhone, iPad and Mac.

The catch is the command line. Tools that ship with macOS or the Xcode Command Line Tools, including curl, git, python3, ruby, perl and openssl, check certificates against a plain file at /etc/ssl/cert.pem. Apple says those tools don't consult its block list or check revocation for certificates that chain to a root in that file. That file only changes with a macOS update, and Apple hasn't given a date for the one that fixes it. [MacRumors](https://www.macrumors.com/2026/10/25/apple-blocks-compromised-emudhra-certificates/?ref=blog.harshkohli.com) confirms there's no release date yet.

## Why it matters

If you never open Terminal, you can stop reading here. Nothing to do.

If you're a developer or admin, though, scripts that pull packages, clone repos or call APIs often go through exactly those tools. In theory, someone holding one of the leaked keys could make a fake certificate for any site and your Mac's curl would accept it. There's still no public evidence the keys were abused, and the security firm [Deimos](https://www.deimoscore.com/newsroom/2026-10-21-updated-macs-still-trust-the-leaked-emudhra-keys/?ref=blog.harshkohli.com) says its own tests on a fully updated Mac showed git, curl, python3 and openssl accepting a test site signed with one of the compromised keys. Also worth knowing: some apps carry their own certificate bundle and ignore both Apple's block and that file. For those, you're waiting on the developer.

## What to do

- Regular users: nothing. Keep your devices updated as normal.
- If you rely on Terminal, follow Apple's steps in the support note. You back up /etc/ssl/cert.pem, then remove emSign ECC Root CA - G3\. Removing AAA Certificate Services as well is optional, and it's the only way to stop those tools trusting the six Sectigo cross-signed copies. Copy Apple's commands exactly rather than retyping them.
- Be aware of the trade-off. Pulling AAA Certificate Services out can break some legitimate sites that chain to it through unaffected intermediates.
- A macOS update can put the old file back. Apple says to re-run its check command after each update until the fixed release arrives.
- Managing a fleet? Push the change through your MDM. Fleet has also published a [remediation script](https://github.com/fleetdm/fleet/blob/main/docs/solutions/macos/scripts/remediate-emudhra-ca-compromise-macos.sh?ref=blog.harshkohli.com) you can review.

I'll update this when Apple ships the macOS release with the fixed certificate file.