MyTechDailyNews Software: Apple's eMudhra TLS CA Block and Optional Terminal Checks on Mac
For readers following software trust changes through MyTechDailyNews Software, the key point is that Apple started automatically blocking compromised eMudhra TLS intermediate CA certificates on Apple devices on 19 October 2026, and the information was published on October 23, 2026. The change is already visible inside Safari, Mail, and apps that rely on Apple networking and security frameworks. The narrower exception is Terminal on Mac: some command-line tools supplied with macOS or the Xcode Command Line Tools validate against /etc/ssl/cert.pem and may continue to accept the affected certificates until a future software update.
What MyTechDailyNews Software needs to say up front
If you do not use Terminal in your workflow, you do not have a file-editing task to perform. If you administer Mac machines for developers or operators, the remaining question is whether you want to wait for Apple's future update or remove the relevant root CA certificates from /etc/ssl/cert.pem now.
Compromise details that matter for software selection
The private keys of eight intermediate CAs operated by eMudhra were compromised. Two of these CAs issue code signing certificates, which Apple's frameworks do not trust. The remaining six issue TLS certificates. A person with keys from these six CAs could create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates.
Each of the 6 TLS intermediate CAs has two certificates, for 12 in total:
- A certificate issued by emSign Root TLS CA - G3, which chains to emSign ECC Root CA - G3
- A certificate cross-signed by Sectigo, which chains to AAA Certificate Services
How Apple delivers the block
Apple began blocking these 12 certificates on Apple devices on 19 October 2026. The blocking data is certificate configuration data; it is sent automatically and as needed, so the initial change does not require installing a software update. Apple also says further updates to the block are coming and will be delivered automatically. Apple also began blocking emSign ECC Root CA - G3 on 23 October 2026.
Apple is also working to make certificate checks agree in other Mac locations. The known gap is command-line tooling that consults /etc/ssl/cert.pem. Apple states the needed changes will arrive in a future software update, and users will not need to edit files to receive them.
Why /etc/ssl/cert.pem is the only file most readers should think about
Most users do not need to edit /etc/ssl/cert.pem. Safari, Mail, and apps that use Apple's networking and security frameworks do not read that file, and Apple devices block these certificates inside them automatically.
On Mac, some command-line tools included with macOS or the Xcode Command Line Tools, including curl, git, python3, ruby, perl, and openssl, check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, those tools do not consult Apple's block or whether the certificate has been revoked. The file will be updated in a future macOS update. If you use these tools and do not want to wait, removing root CA certificates from the file can stop the tools sooner.
Some applications and tools carry their own list of root CA certificates and do not use Apple's block or /etc/ssl/cert.pem. For those apps or tools, contact the developer.
Comparison of validation paths
| Validation path | Current behavior described in the note | What it means for Mac users |
|---|---|---|
| Apple networking and security frameworks | The affected eMudhra TLS certificates are blocked automatically in Safari, Mail, and apps that rely on those frameworks. | No manual Terminal change is needed for this path. |
| macOS or Xcode Command Line Tools paths that use /etc/ssl/cert.pem | Tools such as curl, git, python3, ruby, perl, and openssl may continue to accept certificates that chain through this file until a future macOS update. | Administrators can wait for the update or optionally remove root CA certificates. |
| Apps with their own trust store | Those applications do not use Apple's block or /etc/ssl/cert.pem. | Contact the app developer for guidance about that software. |
Optional Terminal procedure for Mac administrators
This procedure affects every tool that uses /etc/ssl/cert.pem. Afterward, tools that use only this file may not verify some websites whose certificates chain to these root CA certificates through unaffected intermediate CAs.
You need an administrator account, or you can deploy the commands with your device management solution. Copy each command exactly as written. Learn what to do if you get an alert about possible malware when pasting the command into Terminal.
Step 1: Keep a backup of the file
If a backup already exists, this command keeps it:
[ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.origStep 2: Remove emSign ECC Root CA - G3
This command makes a copy of the file without emSign ECC Root CA - G3, checks that the copy is not empty, and replaces the original. It shows nothing when it succeeds:
t=$(mktemp) && awk -v s='=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"Step 3: Optional, remove AAA Certificate Services
Removing emSign ECC Root CA - G3 does not block the six certificates that Sectigo cross-signed, because these tools can still verify them through AAA Certificate Services. To stop these tools from accepting those six certificates through the file until Apple's software update is installed, you can also remove AAA Certificate Services. This command works the same way as the one in step 2:
t=$(mktemp) && awk -v s='=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"Step 4: Confirm the result
This command lists either root CA certificate if it is still in the file. If you removed both, it shows nothing. If the command shows an error, restore the backup from step 1.
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' .What to do after each macOS update
A macOS software update can replace /etc/ssl/cert.pem with Apple's version. Until the software update that contains Apple's changes is installed, run the command in step 4 after each software update. If it lists a root CA certificate that was removed, the update replaced the file. Delete the old backup using sudo rm /etc/ssl/cert.pem.orig, then repeat the steps. After installing the update that contains Apple's changes, these steps are not needed for command-line tools included with macOS or the Xcode Command Line Tools.
Checklist for different readers
- Everyday browser and Mail readers: no Terminal action is needed, because Apple's automatic block already covers those paths.
- Developers and administrators: decide whether to wait for the future macOS update or remove root CA certificates now.
- Fleet operators: run the commands from an administrator account or deploy them through device management, then verify after each update.
- Users of independent apps: check whether the app uses Apple's block or /etc/ssl/cert.pem; if it carries its own trust store, contact the developer.
Common misconceptions
- A current software update is required for the first certificate block. It is not; certificate configuration data is delivered automatically and as needed.
- Editing /etc/ssl/cert.pem fixes every application on Mac. It does not; some apps have their own trust store and do not use that file.
- Removing only emSign ECC Root CA - G3 blocks all affected Terminal validations. It does not; the six Sectigo cross-signed certificates can still be verified through AAA Certificate Services unless that root is also removed.
- A manual edit stays in place after every update. It may not; a macOS software update can replace the file with Apple's version.
FAQ
Do I need to install a macOS update right now?
For the initial block of the 12 certificates, no software update is required because Apple sends certificate configuration data automatically. For command-line tools that use /etc/ssl/cert.pem, a future software update is expected to make the block consistent.
Will Safari and Mail need extra protection?
No. Safari and Mail rely on Apple's networking and security frameworks, and Apple devices already block the certificates in those paths.
What happens if I remove a root CA certificate?
Every tool that uses /etc/ssl/cert.pem is affected. Some websites whose certificates chain to the removed roots through unaffected intermediate CAs may no longer verify in tools that rely only on this file.
Can a tool still accept a revoked certificate?
The note says that, for certificates chaining to a root CA in /etc/ssl/cert.pem, some command-line tools do not consult Apple's block or whether the certificate has been revoked.
Should independent apps be edited through the same command?
Not necessarily. Apps with their own trust store do not use Apple's block or /etc/ssl/cert.pem, so the app developer needs to address those tools.
Reference data: blocked TLS intermediate certificates
The following certificate data reproduces the blocking reference from the software note.
| TLS intermediate certificate | Subject issuer | SHA-256 fingerprint |
|---|---|---|
| EM EV TLS CA - G3B | emSign Root TLS CA - G3 | E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 |
| EM OV TLS CA - G3B | emSign Root TLS CA - G3 | 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B |
| EM DV TLS CA - G3B | emSign Root TLS CA - G3 | 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493 |
| EM EV TLS CA - G3C | emSign Root TLS CA - G3 | 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3 |
| EM OV TLS CA - G3C | emSign Root TLS CA - G3 | CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F |
| EM DV TLS CA - G3C | emSign Root TLS CA - G3 | 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19 |
| EM EV TLS CA - G3B | AAA Certificate Services | 579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512 |
| EM OV TLS CA - G3B | AAA Certificate Services | 5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699 |
| EM DV TLS CA - G3B | AAA Certificate Services | 45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE |
| EM EV TLS CA - G3C | AAA Certificate Services | FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F |
| EM OV TLS CA - G3C | AAA Certificate Services | 7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489 |
| EM DV TLS CA - G3C | AAA Certificate Services | 62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72 |
This reference data reflects information published on October 23, 2026, including Apple's block start on 19 October 2026 and the additional root block on 23 October 2026. MyTechDailyNews Software recommends treating this as a software trust decision for Mac Terminal users rather than a reason for general readers to modify files.