Science & Tech · Cybersecurity · 1 hr ago
Apple blocks compromised eMudhra certificates, plans macOS fix
Apple is blocking compromised eMudhra web certificates in Safari, Mail and apps using its networking and security frameworks.
The certificates belong to Indian company eMudhra, and weak keys tied to eight of its intermediate certificate authorities were discovered earlier this month.
Those keys could have let attackers impersonate legitimate websites, but there is no evidence they were used maliciously.
Apple says the certificates have been blocked since October 19, and the change applies automatically without a software update.
Most Apple device owners do not need to take action, but some Mac command-line tools may still accept the certificates.
Apple says system administrators can remove the relevant root certificates from a system file while they wait for a macOS update.
Apple has not announced when that update will arrive.
Weak private keys tied to eight eMudhra intermediate certificate authority certificates could have allowed attackers to impersonate legitimate websites.
Apple says there is no evidence the keys were used maliciously.
Since October 19, Apple has blocked the compromised TLS certificates in Safari, Mail and apps using its networking and security frameworks.
Most Apple device owners need to take no action because the certificates are blocked automatically.
Some macOS command-line tools may still accept the certificates, and Apple plans to address this in a macOS update with no release date announced.
- Who
- Apple and eMudhra, an Indian company. The issue also affects users of some macOS command-line tools.
- What
- Apple is blocking compromised eMudhra TLS certificates and plans a macOS update to address command-line tools that may still accept them.
- When
- Apple has blocked the certificates since October 19. The macOS update has no announced release date.
- Where
- In Safari, Mail, and apps using Apple's networking and security frameworks; the remaining issue concerns some macOS command-line tools.
- Why
- Weak private keys could have allowed attackers to impersonate legitimate websites and put users' sensitive information at risk.
This story does not have two clearly opposing sides.
A security researcher discovered weak private keys associated with eight eMudhra intermediate certificate authority certificates.
Apple began blocking eMudhra's compromised TLS web certificates in Safari, Mail and apps using its networking and security frameworks.
MacRumors reported Apple's blocking measures and its plan for a macOS update.
- Affected certificates
- Eight eMudhra intermediate certificate authority certificates
- Blocking began
- October 19
- Apple apps and services
- Safari, Mail and apps using Apple's networking and security frameworks
- Potentially affected tools
- Some macOS command-line tools
- Manual workaround
- Remove root CA certificates from /etc/ssl/cert.pem
What people are saying
those who use macOS command-line tools, such as system administrators, should be aware that some of those tools can still accept the compromised certificates until Apple releases a macOS update with a fix