If your Mac cannot install macOS Golden Gate 27.2.1, macOS Tahoe 26.7.3 or macOS Sequoia 15.8.3, you can remove the eMudhra root certificates yourself with four Terminal commands. Updating is the better fix, because those three versions block the compromised certificates in command-line tools and take the roots out of the certificate file for you.
Safari, Mail and other apps that use Apple’s networking frameworks already block the compromised eMudhra certificates, so the gap is in tools such as curl, git and openssl that check certificates against the /etc/ssl/cert.pem file instead. The steps below need an administrator account, or you can deploy the commands through a device management tool.
Three macOS Versions Include the Fix
Open System Settings, then General, then Software Update, and your Mac offers the version that matches the macOS release it runs. Each of the three versions blocks the 12 compromised certificates in the command-line tools that come with macOS and the Xcode Command Line Tools.
The update also removes emSign ECC Root CA – G3 and AAA Certificate Services from /etc/ssl/cert.pem, along with three other eMudhra roots named emSign Root CA – G1, emSign Root CA – C1 and emSign ECC Root CA – C3. A Mac that is too old for macOS Sequoia 15 cannot install any of the three versions, so Apple’s manual steps are the option for that Mac.
Back Up cert.pem Before You Edit It
Open Terminal, which is in the Utilities folder inside your Applications folder, or find it with Spotlight. Copy each command exactly as written. Terminal can show an alert about possible malware when you paste a command, and Apple has a separate support article on what to do.
The first command makes a copy of the certificate file named cert.pem.orig, and it keeps any backup that already exists. Terminal asks for your administrator password the first time a command needs it, and it does not show the password as you type.
[ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig
Remove the eMudhra Root Certificates
emSign ECC Root CA – G3
The second command writes a copy of the file without emSign ECC Root CA – G3, checks that the copy is not empty and then replaces the original. The command shows nothing when it works.
t=$(mktemp) && awk -v s='=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"
This root covers six of the 12 certificates, the ones that chain to emSign Root TLS CA – G3. The six that Sectigo cross-signed still verify through AAA Certificate Services, so command-line tools keep accepting them until you remove that root too.
AAA Certificate Services (optional)
The third command works the same way and stops the tools from accepting the six Sectigo cross-signed certificates through the file. The removal lasts only until you install the macOS update that carries Apple’s own changes.
t=$(mktemp) && awk -v s='=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"
Both removals affect every tool that uses /etc/ssl/cert.pem. Tools that rely only on that file might fail to verify some websites whose certificates chain to these roots through intermediate authorities that were not affected.
One Command Shows Which Roots Remain
The last command lists emSign ECC Root CA – G3 and AAA Certificate Services if either one is still in the file. The command shows nothing if you removed both roots, and you should restore the backup from the first step if it shows an error.
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services'
A macOS Update Can Bring the Roots Back
A macOS software update can replace the file with Apple’s version and bring the roots back. Run the check command after every update, and repeat the steps if it lists a root you removed.
Once your Mac runs one of the three fixed versions, you do not need to repeat the steps. Delete your backup with the command below, and do not restore a backup you made before the update.
sudo rm /etc/ssl/cert.pem.orig
These steps also do not reach apps and tools that carry their own list of root certificates, because those ignore both Apple’s block and /etc/ssl/cert.pem. Apple tells users of such apps to contact the developer.
