First screen, captured 1 day ago. Hover to scroll the page, or open the video.

Apple's git still trusts the compromised eMudhra certificates

Advisory page saying Apple's macOS-bundled git, curl and python3 still trust compromised eMudhra certificates, with test commands and a manual workaround.

What HN thinks

Ten days, two trust stores, and one update that helpfully un-fixed the fix.

macOS is the culprit, not git
Git and curl rightly defer to the OS store; the problem is Apple's stale /etc/ssl/cert.pem, while GUI apps using Security.framework got the revocation within hours.
Apple's response is unacceptable
Telling users to hand-edit the cert bundle, not using the rapid security response channel, and shipping an update that reverted manual fixes is seen as a serious failure.
Threat is real vs overblown
Some argue MITM needs network access and is niche; others point to coffee-shop Wi-Fi, ARP spoofing and mitmproxy support making it practical, especially for git credentials.

Consensus: Most agree Apple should simply push an update removing the roots, and that certificate trust management across OSes, languages and tools is a fragmented mess.

Recommended in the comments

Homebrew ↗ (tool): Ships its own CA bundle for curl, with a fix landing for its git.
MacPorts (tool): Its cert.pem can be symlinked over the system bundle, and it still supports Intel Macs.
distrust ↗ (tool): Shrinks the trusted CA surface after the eMudhra incident.
trust-manager (tool): Avoids rebuilding every container image to update CA certs.

Summarised by Claude from the comment thread 1 day ago.

Points: 1153
Comments: 399
Best rank: #1
Posted: 2026-10-28 by galadran
Category: Security

emudhra certificate-authority macos git tls apple curl supply-chain

All captures:

Full page

Captured 1 day ago. Click for the whole screenshot.

Looks similar

Screenshot of support.apple.com: About the compromised eMudhra intermediate CAs

About the compromised eMudhra intermediate CAs (support.apple.com)

121 points by birdculture 1 day ago | 60 comments

Apple support article explaining its blocking of compromised eMudhra intermediate CA certificates and optional steps to remove root CAs from /etc/ssl/cert.pem on Mac.

certificate-authority emudhra tls pki

Screenshot of emudhra.we-have-a-problem.com: eMudhra intermediate CA compromise

eMudhra intermediate CA compromise (emudhra.we-have-a-problem.com)

1124 points by galadran 9 days ago | 503 comments

Disclosure page reporting that private keys of eight eMudhra intermediate CA certificates trusted by major root programs were compromised, with signed proof.

emudhra certificate-authority pki tls