Apple says macOS 27.2.1 blocks eMudhra certificates in command-line tools

Apple has said that command-line tools stop accepting compromised eMudhra certificates starting in macOS 27.2.1, and that macOS 26.7.3 and macOS 15.8.3 include the same protection. The support page carrying that statement is dated November 9, 2026.

Three macOS versions block the certificates in command-line tools. Apple says curl, git, and other command-line tools shipped with macOS or the Xcode Command Line Tools have needed a separate step to reject the certificates. Those tools stop accepting them starting in macOS 27.2.1. The page says macOS 26.7.3 covers Macs on macOS 26, and macOS 15.8.3 covers Macs on macOS 15. Apple's security releases page dates macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3, and macOS Sequoia 15.8.3 to November 9, 2026.

Safari and Mail already block the certificates without an update. Apple says its devices automatically block certificates from the compromised eMudhra intermediate CAs that issue TLS certificates. The block covers Safari, Mail, and apps that use Apple's networking and security frameworks. Apple sends the certificate configuration changes automatically, so that part of the block does not wait on a software update.

Eight intermediate CAs had their private keys compromised. Apple says two of the eight issue code signing certificates, which its frameworks do not trust. The other six issue TLS certificates. A person holding keys from those six could produce certificates that look legitimate for any website, Apple says. Apple says eMudhra revoked the certificates, and so did Sectigo. Each of the six TLS intermediate CAs has two certificates, 12 in all. One set is issued by emSign Root TLS CA - G3 and chains to emSign ECC Root CA - G3. The other set is cross-signed by Sectigo and chains to AAA Certificate Services.

The updates remove five root CA certificates. Starting in macOS 27.2.1, Apple says, macOS also blocks those 12 certificates inside the command-line tools included with macOS or the Xcode Command Line Tools. The same versions remove the two root CA certificates the 12 certificates chain to from /etc/ssl/cert.pem, plus three other eMudhra root CA certificates. macOS 26.7.3 and macOS 15.8.3 include that removal. Apple names the five roots as emSign ECC Root CA - G3, AAA Certificate Services, emSign Root CA - G1, emSign Root CA - C1, and emSign ECC Root CA - C3.

Tools with their own root lists stay outside the block. Apple says some apps and tools keep a separate list of root CA certificates and do not consult Apple's block or /etc/ssl/cert.pem. On a Mac that cannot move to macOS 27.2.1, macOS 26.7.3, or macOS 15.8.3, curl, git, python3, ruby, perl, and openssl still check certificates against that file. Certificates that chain to a root in the file are not checked against Apple's block or revocation, the page says. Removing the roots can leave tools that rely only on the file unable to verify some sites whose certificates chain to those roots through intermediate CAs that were not affected.