Earlier this month, a security researcher discovered that private cryptographic keys associated with eight intermediate certificate authority (CA) certificates from Indian company eMudhra were weak. The compromised keys could have allowed attackers to impersonate legitimate websites, potentially putting users’ sensitive information at risk. However, there is currently no evidence that the keys have been exploited maliciously.
eMudhra’s certificates were widely trusted by all major web browsers, including Safari, Chrome, Edge, and Firefox, but Apple and the other companies behind these browsers have since taken steps to protect users.
In a support document, Apple said it has blocked eMudhra’s compromised TLS web certificates since October 19 in Safari, Mail, and apps that use Apple’s networking and security frameworks. Certificates are automatically blocked with no software update required, so most Apple device owners don’t need to take any action.
There is one exception. Apple said that those who use macOS command-line tools, such as system administrators, should be aware that some of these tools may still accept compromised certificates until Apple releases a macOS update with a fix. Meanwhile, Apple said that those using command-line tools can remove root CA certificates from the /etc/ssl/cert.pem file, with more details outlined in the support document.
Apple has not provided a release date for the macOS update which will include the necessary changes to the /etc/ssl/cert.pem file by default.
For more technical details, read Apple’s support document.
