The first macOS Golden Gate 27.3 beta stops curl, git and other Terminal tools from trusting the compromised eMudhra certificates. Safari and Mail have blocked them since October, so the change only matters if you run command-line tools on your Mac.
Apple has said the fix for those tools will arrive in a future macOS update, without giving a date, and administrators who do not want to wait can remove the root certificates by hand. Anyone who stays out of Terminal does not need to do anything.
Command-line tools could still accept the eMudhra certificates
Apple began blocking the 12 affected certificates on October 19 and added the emSign ECC Root CA – G3 on October 23. The block reaches Safari, Mail and any app that uses Apple’s networking and security frameworks through automatic updates, so no software update was needed.
Command-line tools work differently, because curl, git, python3, ruby, perl and openssl read the root certificates in /etc/ssl/cert.pem and do not check Apple’s block or whether a certificate was revoked. The macOS Golden Gate 27.3 beta removes the affected certificates from that file, so those tools no longer accept them.
The beta is build 26C5035r, and registered developers can install it from Software Update. It also adds Markdown formatting in Quick Look and the Pro Light screensaver.
Six of the eight compromised authorities issue website certificates
The private keys of eight eMudhra intermediate certificate authorities were compromised. Two of them issue code signing certificates, which Apple’s frameworks do not trust, and the other six issue the TLS certificates that websites use.
Someone holding the keys for those six could create certificates that appear valid for any website. eMudhra and Sectigo have revoked the affected certificates.
Each of the six authorities has two certificates, which makes 12 in total. One is issued by emSign Root TLS CA – G3 and chains to emSign ECC Root CA – G3, and the other is cross-signed by Sectigo and chains to AAA Certificate Services.
The manual steps need two roots removed to cover all 12 certificates
Removing emSign ECC Root CA – G3 from the file blocks six of the 12 certificates. The six that Sectigo cross-signed still verify through AAA Certificate Services, so you also have to remove that root to cover all 12.
The steps need an administrator account or a device management tool, and they affect every tool that reads the file. Tools that rely only on it might then fail to verify some websites whose certificates chain to those roots through unaffected intermediates.
A macOS update can also replace the file with Apple’s version and bring the roots back. After each update, run Apple’s check command and repeat the steps if the result still shows a root you removed.
Apps and tools that bundle their own root certificates ignore both Apple’s block and the file. Apple tells users of those apps to contact the developer.
