Apple patches eMudhra certificate flaw in macOS command-line tools
The macOS Golden Gate 27.2.1 update extends protection to tools including curl and git, which could still accept compromised certificates.
Apple has released macOS Golden Gate 27.2.1 to stop command-line tools from accepting compromised eMudhra security certificates. The company recommends installing the latest software and has also released macOS 26.7.3 and macOS 15.8.3 for Macs running those operating systems.
An October block had already prevented Safari, Mail and applications built on Apple frameworks from accepting the certificates. However, command-line tools including curl and git remained able to accept them, leaving a gap addressed by macOS 27.2.1.
The certificates came from certificate authority eMudhra. A Mozilla investigation found that their private key values were below 256, making the keys easy to recover. Attackers could use those keys to generate fraudulent certificates that would appear valid for any website.
Before issuing the update, Apple provided instructions for manually deleting affected root certificates from the Mac file "/etc/ssl/cert.pem". That guidance remains available for people unable to update. Apple has also addressed the flaw in the macOS Golden Gate 27.3 beta, but the 27.2.1 update makes the protection available without waiting until December.
