Apple Blocks 12 Web Certificates From eMudhra After Eight Signing Keys Were Compromised

Apple has blocked 12 web security certificates linked to eMudhra after the private keys of eight intermediate certificate authorities run by the company were compromised. The block has applied since October 19 in Safari, Mail and any app that relies on Apple's networking and security frameworks, so most iPhone and Mac users are covered without doing anything. Command-line tools on the Mac are the gap, and they need a software update that Apple has not dated.

What Apple says happened

Apple explained the problem in a support document published on October 23, titled "About the compromised eMudhra intermediate CAs". It says the private keys of eight intermediate certificate authorities operated by eMudhra were compromised. Two of them are code-signing authorities, which Apple's frameworks do not trust. The other six issue certificates for secure web connections, known as TLS certificates, and those are the ones Apple has blocked.

Each of the six has two certificates, making 12 in total. One of each pair was issued by emSign Root TLS CA - G3, which chains to the emSign ECC Root CA - G3 root. The other was cross-signed by Sectigo and chains to a root called AAA Certificate Services. Apple lists the SHA-256 fingerprints of all 12 in its document so administrators can check them.

The risk is spelled out in Apple's own words: someone holding keys from these six authorities "could create certificates that appear valid for any website". In practice that means an attacker could set up a fake site or intercept traffic and present a certificate that browsers would otherwise accept. Apple says eMudhra and Sectigo have both revoked the affected certificates.

MacRumors, which reported the story on October 25, says a security researcher discovered the compromise earlier this month and that there is no evidence the keys were used maliciously. Apple's document does not say when the keys were compromised or who found the problem, and no researcher has been named in the coverage we reviewed.

What is protected now

Apple blocks the 12 certificates through automatic configuration data updates, which means no iOS or macOS update was needed and the block arrived quietly on October 19. On October 23 Apple went a step further and also blocked the emSign ECC Root CA - G3 root itself, a step MacRumors did not mention. Safari, Mail and apps built on Apple's frameworks will refuse connections that depend on any of these certificates.

What is not protected yet

Tools on macOS that read their trusted roots from a file at /etc/ssl/cert.pem are a different story. Apple says a future macOS update will extend the block to command-line tools that use that file, and names curl, git, python3, ruby, perl and openssl as examples. Until then, those tools can still accept the eMudhra certificates. Apple has given no release date, and MacRumors says the same.

For administrators who cannot wait, Apple's document gives an interim workaround: remove the emSign ECC Root CA - G3 entry, and optionally the AAA Certificate Services entry, from /etc/ssl/cert.pem, using commands it lists. It also says that most users do not need to touch the file. Because editing a system trust file is a manual change with consequences, administrators should follow Apple's exact commands and keep a backup of the original.

Other browsers

MacRumors states that eMudhra's certificates were trusted by all major browsers, including Chrome, Edge and Firefox, and that the companies behind them have acted. We could not confirm that from a primary source from Google, Microsoft or Mozilla, and Apple's document does not mention other vendors. Readers using those browsers should check their vendors' security notices before assuming they are covered.

Why it matters in India

eMudhra is an India-based certificate authority, which makes the story relevant to Indian organisations that buy certificates or digital signatures from it. We found no statement from eMudhra in the coverage we reviewed, and no report describing the impact on Indian customers, so how many sites and services use the blocked certificates is unknown. Anyone who runs a site with an eMudhra certificate should confirm with the company that it has been reissued from a new chain, because a revoked certificate will stop working for visitors on Apple devices.

What to watch next

Three things matter now: a statement from eMudhra on how the keys were exposed, a date for Apple's macOS update that closes the command-line gap, and confirmation from the other browser makers. Until all three arrive, the practical advice is the same as Apple's: Apple's own apps are protected, and Mac power users should read the support document before the update lands.

Published October 26, 2026. Gadgets365 will update this article as more information becomes available.