My and Claude Opus's Guide to Fix Your Mac's Certificates Following the eMudhra Incident

Disclaimer: I am not a security specialist, but I am a computer nerd and an experienced software engineer. Use at your own risk, YMMV, etc., etc.

If you have been following tech news this week you will have noticed that the private key of 8 eMudhra Intermediate CA certificates were compromised. Mozilla was notified on October 17, 2026 and you can find the Mozilla report here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

This is really bad. On a scale of 1 to 10, it's like a 9. It allows for Man-in-the-Middle (MITM) attacks everywhere. On the whole internet. The key generation ceremony was held on April 30,2025, so this has been out there for about 18 months. A script error resulted in issuing CA's with weak keys.

Your browser is safe because there are safeguards built-in that allowed Google Chrome, etc. to pull the compromised certificate chains immediately. Your Apple applications (Mail, Safari, etc.) are safe because Apple pushed fixes to all devices that updated the certificates on your machine. See Apple's support article here describing what they did: https://support.apple.com/en-us/149555

Naturally, I fed this information to Claude Opus and did what I was told by the AI to fix it. Below are the steps I took. Use at your own risk, but in my opinion the risk is greater if you choose to do nothing.

If you're like me you also run a cornucopia of tools on your machine in Terminal that run outside the browser. All of those tools are susceptible to attack due to these compromised intermediate CA certificates until you fix them. According to Apple's support article in the section "Do I need to edit /etc/ssl/cert.pem?" the following tools are likely compromised if you have not yet updated your certificate settings:

• some command-line tools included with macOS
• Xcode Command Line Tools (curl, git, python3, ruby, perl, openssl)
• Any other tools that check certificates against /etc/ssl/cert.pem

Apple's support article also includes a very important warning: "A macOS software update can replace /etc/ssl/cert.pem with Apple's version. Until you install the software update that includes Apple's changes, run the command in step 4 after each software update. If it lists a root CA certificate that you removed, the update replaced the file." In other words, a macOS update can break the certs for your Terminal tools again. Be vigilant.

I recommend running Apple's four step process to remove the affected root CA certificates from /etc/ssl/cert.pem . Once that's finished, below are a few more items to check.

Upgrade Node to the latest version. If you're using LTS, that's version 24.22.1 as of this writing, but this should shift to 26.x before the end of the month.

Run this to upgrade Homebrew (note: you may see openssl@3 upgrade from 3.6.x to 3.5.x - this is expected):

brew update && brew upgrade ca-certificates openssl@3

Upgrade certifi . The python.org installer points Python’s ssl module at certifi’s bundle, so updating certifi fixes both requests and the standard library.

python3 -m pip install --upgrade certifi

Put these in your ~/.zshrc :

export SSL_CERT_FILE=/opt/homebrew/etc/ca-certificates/cert.pem
export REQUESTS_CA_BUNDLE=/opt/homebrew/etc/ca-certificates/cert.pem
export CURL_CA_BUNDLE=/opt/homebrew/etc/ca-certificates/cert.pem
git config --global http.sslCAInfo /opt/homebrew/etc/ca-certificates/cert.pem

Run this in your Terminal. Both should point at the Homebrew bundle or at an updated certifi bundle.

source ~/.zshrc
/usr/bin/curl -sv https://example.com -o /dev/null 2>&1 | grep -i cafile
python3 -c "import ssl, certifi; print(ssl.get_default_verify_paths().cafile); print(certifi.where())"

Run this command to check /etc/ssl/cert.pem, Homebrew's certs, and Python's certs:

for b in /etc/ssl/cert.pem /opt/homebrew/etc/ca-certificates/cert.pem "$(python3 -m certifi)"; do
  echo "== $b"
  openssl crl2pkcs7 -nocrl -certfile "$b" | openssl pkcs7 -print_certs -noout \
    | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services' || echo "  neither present"
done

For good measure, run this command to check the same places for the G3 root cert's fingerprint:

for b in /etc/ssl/cert.pem "$(brew --prefix)/etc/ca-certificates/cert.pem" "$(python3 -m certifi 2>/dev/null)"; do
  [ -f "$b" ] || continue
  echo "== $b"
  awk '/BEGIN CERT/{c=""} {c=c $0 "\n"} /END CERT/{printf "%s", c > "/tmp/c.pem"; close("/tmp/c.pem"); system("openssl x509 -in /tmp/c.pem -noout -fingerprint -sha256")}' "$b" \
    | grep -i "86:A1:EC:BA" && echo "  ^ still trusts emSign ECC G3" || echo "  clean"
done

Check to see if there are any emSign certs that your Mac trusts by running this command. The one that matters is emSign ECC Root CA - G3, which signed the compromised intermediates.

mkdir -p ~/emsign && cd ~/emsign
security find-certificate -a -c "emSign" -p \
  /System/Library/Keychains/SystemRootCertificates.keychain > all.pem
awk '/BEGIN CERT/{n++} {print > ("emsign-" n ".pem")}' all.pem
for f in emsign-*.pem; do echo "== $f"; openssl x509 -in "$f" -noout -subject -fingerprint -sha256; done

Compare the SHA-256 fingerprints with the root’s entry on crt.sh or in Mozilla’s bug before you block anything.

Mark the G3 file untrusted if you find it by replacing emsign-N.pem in the script below with the number the previous command output (example: emsign-1.pem), then run the script:

sudo security add-trusted-cert -d -r deny -k /Library/Keychains/System.keychain emsign-N.pem

Check that it took effect:

security dump-trust-settings -d        # should list emSign with "Deny"

Cleanup:

rm -rf ~/emsign
rm -f /tmp/c.pem      # left behind by the fingerprint script

Finally, test your tools:

/usr/bin/curl -sSo /dev/null -w 'system curl: %{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com

curl -sSo /dev/null -w 'brew curl: %{http_code}\n' https://dv-g3b-emudhra.we-have-a-problem.com

An HTTP 200 means the tool is still vulnerable. A certificate error means it’s protected. This site tests one chain, so treat a pass as a good sign rather than proof.

Best wishes and stay safe out there.