Summary
Apple says macOS 27.2.1, 26.7.3 and 15.8.3 block compromised eMudhra TLS certificates in command-line tools. The changes address a gap between Apple's automatic certificate blocking in apps such as Safari and the trust files used by some Mac command-line utilities.
Apple says macOS 27.2.1, macOS 26.7.3 and macOS 15.8.3 add protection against compromised eMudhra TLS certificates in command-line tools. The updates address a difference in how some Mac utilities check certificates compared with Safari, Mail and apps that use Apple's networking and security frameworks.
The private keys of eight intermediate certificate authorities (CAs) operated by eMudhra were compromised, according to Apple. Two of the CAs issue code-signing certificates that Apple's frameworks do not trust. The other six issue TLS certificates, which help establish that a website is the site it claims to be. Someone holding the compromised keys could create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates.
Why command-line tools needed separate protection
Apple devices automatically block the 12 affected TLS certificates in Safari, Mail and apps using Apple's frameworks. Apple sends certificate-configuration updates to devices as needed, so this protection does not require installing a macOS software update.
Some command-line tools take a different route. Utilities such as curl, git, python3, ruby, perl and openssl may check certificates against /etc/ssl/cert.pem. Apple says tools relying on this file do not check Apple's block or whether a certificate has been revoked when its chain leads to a root CA certificate in the file. A certificate chain links a website's certificate through one or more intermediate authorities to a root authority trusted by the system or tool.
Starting with macOS 27.2.1, Apple's command-line tools and those in the Xcode Command Line Tools block the 12 affected certificates. The same protection is included in macOS 26.7.3 and macOS 15.8.3. These versions also remove five root CA certificates from /etc/ssl/cert.pem: emSign ECC Root CA - G3, AAA Certificate Services, emSign Root CA - G1, emSign Root CA - C1 and emSign ECC Root CA - C3.
Options for Macs that cannot update
For a Mac that cannot be updated to one of those versions, Apple documents removing root CA certificates from /etc/ssl/cert.pem. Removing emSign ECC Root CA - G3 addresses one certificate chain. Apple describes removing AAA Certificate Services as optional: some affected certificates were cross-signed, so command-line tools could still validate them through that authority.
Changing this shared trust file affects every tool that uses it. Apple warns that tools relying only on the file might then be unable to verify some websites whose certificates chain to the removed roots through unaffected intermediate authorities. The workaround therefore has a broader effect than blocking the compromised certificates alone.
Some apps and tools maintain their own root-certificate lists and do not use Apple's block or /etc/ssl/cert.pem; Apple directs users to contact those developers. Macs updated to macOS 27.2.1, 26.7.3 or 15.8.3 do not need the manual removal steps.