Apple Blocks Compromised eMudhra Intermediate CAs
Original title: About the compromised eMudhra intermediate CAs
Apple is blocking certificates from six compromised eMudhra intermediate CAs that issue TLS certificates, with further updates for command-line tools.
Since 19 October 2026 Apple has blocked 12 certificates from six eMudhra intermediate CAs after their private keys were compromised. The CAs could have issued fake TLS certificates for any website. eMudhra and Sectigo have revoked the affected certificates; Apple continues automatic updates.
Unconfirmed: No confirmed exploitation of the compromised keys
- Affects Safari, Mail and Apple frameworks automatically
- Root CA removal required for Terminal tools using /etc/ssl/cert.pem
- Further blocks for emSign ECC Root CA - G3 planned
Impact: potential issuance of forged TLS certificates
| Product | Affected |
|---|---|
| Apple Safari, Mail, macOS command-line tools | — |
- 1.Remove emSign ECC Root CA - G3 and AAA Certificate Services from /etc/ssl/cert.pem
- 2.Wait for macOS update to /etc/ssl/cert.pem
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 0164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19 | B012AC00BF9C7C3F EM DV TLS CA - G3C emSign Root TLS CA - G3 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19 EM EV TLS CA - G3B AAA Certificate Services 579480AEA166290 |
| sha256 | 42c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493 | 82374CE5833BC25B EM DV TLS CA - G3B emSign Root TLS CA - G3 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493 EM EV TLS CA - G3C emSign Root TLS CA - G3 432EC25F0D28DE90 |
| sha256 | 432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3 | 0EC427E118BA1493 EM EV TLS CA - G3C emSign Root TLS CA - G3 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3 EM OV TLS CA - G3C emSign Root TLS CA - G3 CB6E15165AC802E9 |
| sha256 | 45a883f349aedfd5f3a649b5498ffb121712ba8b448f3f2a91dbc5a766fcddbe | BD43579BD832699 EM DV TLS CA - G3B AAA Certificate Services 45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE EM EV TLS CA - G3C AAA Certificate Services FD9D5C2DBBD4995 |
| sha256 | 579480aea166290bd3c643589e795fc0d0e54e86505d180f1dff99efd3199512 | 1D9558C30934D19 EM EV TLS CA - G3B AAA Certificate Services 579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512 EM OV TLS CA - G3B AAA Certificate Services 5F1DED4DD590AF7 |
| sha256 | 5f1ded4dd590af74631290cf073b122a2aac6a1fa479778a0bd43579bd832699 | DFF99EFD3199512 EM OV TLS CA - G3B AAA Certificate Services 5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699 EM DV TLS CA - G3B AAA Certificate Services 45A883F349AEDFD |
| sha256 | 62b7f9868263f72f6911fc78ceaf72c1979158b7368bf648683bb2aa39b02e72 | 7BE5B2039DE9489 EM DV TLS CA - G3C AAA Certificate Services 62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72 Information about products not manufactured by Apple, or in |
| sha256 | 7485b51c0ed192878fa1d2f948fb529ae1842cc5086c4b67f7be5b2039de9489 | 2174EB58F07021F EM OV TLS CA - G3C AAA Certificate Services 7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489 EM DV TLS CA - G3C AAA Certificate Services 62B7F9868263F72 |
| sha256 | 98b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b | 1A3BA75184333838 EM OV TLS CA - G3B emSign Root TLS CA - G3 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B EM DV TLS CA - G3B emSign Root TLS CA - G3 42C4ACCD12C4F595 |
| sha256 | cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3f | 72D9A1148D0261F3 EM OV TLS CA - G3C emSign Root TLS CA - G3 CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F EM DV TLS CA - G3C emSign Root TLS CA - G3 0164D7CEAE5BB909 |
| sha256 | e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838 | -256 fingerprint EM EV TLS CA - G3B emSign Root TLS CA - G3 E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 EM OV TLS CA - G3B emSign Root TLS CA - G3 98B896625C0C230A |
| sha256 | fd9d5c2dbbd4995ab69b8d50c439d9527b00529199c2fd01b2174eb58f07021f | 1DBC5A766FCDDBE EM EV TLS CA - G3C AAA Certificate Services FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F EM OV TLS CA - G3C AAA Certificate Services 7485B51C0ED1928 |
From the original article
5 min read at support.apple.comSince 19 October 2026, Apple has been blocking the certificates of the compromised eMudhra intermediate Certification Authorities (CAs) that issue TLS certificates, and is making additional updates to this block. If you don't use Terminal as part of your workflow, you don't need to do anything.
By support.apple.com via freddyb · support.apple.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.