Post cover image

November 2, 2026

A One-Command Fix for the eMudhra Certificate Compromise on macOS

Safari is protected. curl, git and python3 are not. Here’s how to close the gap.

By Victor L. Batista

2 min read

What happened

The private keys of eight eMudhra intermediate CAs were compromised and reported on October 17, 2026. The keys were generated incorrectly, so anyone can recover them from the certificates. Someone holding the keys of the six TLS intermediates could create certificates that appear valid for any website.

Apple blocks these certificates automatically in Safari, Mail and apps that use its networking and security frameworks. The gap is the command line.

Why your terminal is still exposed

Some tools included with macOS or the Xcode Command Line Tools (curl, git, python3, ruby, perl and openssl) check certificates against /etc/ssl/cert.pem. They don't check Apple's block or revocation, and that file still contains the roots the compromised intermediates chain to:

  • emSign ECC Root CA - G3
  • AAA Certificate Services (for the six Sectigo cross-signed intermediates)

As of November 2, Apple's support article says the file will be fixed in a future macOS update, with no date. Until then, administrators can remove the roots by hand.

The manual fix

  1. Back up /etc/ssl/cert.pem.
  2. Remove emSign ECC Root CA - G3 with awk, then install the result.
  3. Optionally remove AAA Certificate Services too.
  4. Verify with openssl that neither root remains.

The exact commands are in Apple's guidance (support.apple.com/en-us/149555) and at emudhra.we-have-a-problem.com. I applied them on one Mac, then wanted the same result on a second one without pasting five blocks again, so I scripted it.

A gotcha: pip and SIP

The built-in pip3 uses its own outdated CA bundle. The suggested fix appends a PIP_CERT line to sitecustomize.py, which lives inside /Applications/Xcode.app. On my machine it failed:

tee: .../sitecustomize.py: Operation not permitted

That's System Integrity Protection, not sudo. The workaround is to set the variable in your shell instead:

export PIP_CERT=/etc/ssl/cert.pem

The script

The script is on GitHub Gist and does it all:

chmod +x emudhra-fix.sh && ./emudhra-fix.sh

It backs up the file, removes both roots, aborts without touching anything if the awk output is empty, adds PIP_CERT to ~/.zshrc idempotently, and verifies the result. Options: --emsign-only, --check, --restore.

Trade-offs

  • Removing the roots affects every tool that uses /etc/ssl/cert.pem. Some websites that chain to them through unaffected intermediates may fail to verify. This is more likely with AAA Certificate Services, so use --emsign-only if unsure.
  • A macOS update can replace the file. According to the incident site, macOS 27.2 undid user-applied fixes. Run ./emudhra-fix.sh --check after each update. If it lists a root, run the script again; it automatically refreshes a stale backup.
  • Once you install the update that includes Apple's fix, you no longer need any of this.
  • Apps that ship their own CA bundle (Electron apps, some libraries) need their own updates. This doesn't cover them.

Verify it worked

Both commands should fail with a certificate error:

curl https://dv-g3b-emudhra.we-have-a-problem.com/
curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

The second only fails if you removed AAA.

Credits

Commands and research: Apple's support article and Dennis Jackson and contributors at emudhra.we-have-a-problem.com. The script modifies a system file with sudo, so read it before running it.