Apple blocks compromised web certificates: macOS update coming soon

appleis taking action to mitigate a recently discovered web security threat linked to compromised certificates issued by the Indian company eMudhra. While there is no evidence of malicious exploitation, weak cryptographic keys associated with some eMudhra intermediate certificates could have allowed attackers to impersonate legitimate websites, putting users' sensitive information at risk. To protect its users, Apple has begun automatically blocking these compromised TLS certificates on Safari and other applications that use the company's networking and security frameworks, but a macOS-specific update is on the way to completely fix the issue, especially for system administrators who use command-line tools.

The discovery of the vulnerability in eMudhra certificates

Compromised Apple Web Certificates - A security researcher recently identified weaknesses in the private cryptographic keys of eight intermediate certificate authority (CA) certificates from the Indian company eMudhra. These compromised keys could have allowed attackers to create fake certificates, fooling users and browsers into believing they were communicating with authentic websites. eMudhra's certificates were widely trusted by all major web browsers, including Safari, Chrome, Edge, and Firefox, making the potential vulnerability significant.

Apple's intervention: automatic blocking of certificates

In response to this discovery, Apple acted promptly. This blocking occurs automatically, without the need for a software update on the user's part, meaning that most Apple device owners do not need to take any specific action to be protected from this threat.

Exception for macOS command line tools

However, there is an important exception for macOS users. Apple specified that command-line tools, commonly used by system administrators and developers, may still accept compromised certificates until a dedicated update is released. In the meantime, Apple has provided a temporary fix: users who employ these tools can manually remove the root CA certificates from the file/etc/ssl/cert.pem. The company has not yet provided a release date for the macOS update that will implement this fix by default.

Recent security updates for macOS

This intervention is part of a context of growing attention by Apple towards the security of its operating systems. Recently, the company released updates for several versions of macOS, including Sonoma, Sequoia, and Tahoe, to fix security vulnerabilities. For example, a previous version of macOS Tahoe 26.6.1 fixed a flaw that could have allowed an attacker to authenticate to Screen Share without valid credentials. Apple's commitment to promptly releasing security patches highlights the importance of keeping operating systems updated to protect against cyber threats.

Editorial source consulted:MacRumors.