Four no more: macOS 27.3 kills off those stupidly insecure certificates

In the wake of the shockingly insecure security certificate fiasco, Apple has now completely blocked the compromised eMudhra certificates in macOS 27.3.

In October, security researchers discovered that a number of certificates issued by one certificate authority were woefully insecure, to an obscene degree. While Apple has worked to block the certificates from being used, the current developer beta round goes one stage further.

After the discovery of the astoundingly weak certificates, Apple was able to stop the affected certificates from being used on iOS, iPadOS, and its other operating systems. However, as the curl utility in macOS doesn't check revocation information, Macs that had previously trusted the certificates would continue to do so, despite Apple's measures.

Under macOS 27.3 developer beta 1, the update now blocks the affected certificates, even if they have been trusted in the past. Since that version of update will ship to the public in December, Apple may include the same fix in a 27.2.1 release in the meantime.

Apple's support pages also include instructions for system administrators to remove root certificates without updating their Macs.

Four. Really.

In October, security researchers discovered that a series of security certificates from eMudhra, generated in April 2025, were astoundingly insecure. While private keys are usually over 100 digits long, the certificates were found to use very short keys, with the worst example being the digit "4".

Following the discovery, and the inevitable online fallout at such a mistake, Google and Mozilla added blocks on October 17. Similar protections were added to iOS and iPadOS by Apple on October 19, but the same couldn't be done for macOS at the time.

Of the eight certificates, six were used for TLS and trusted by Apple, Chrome, Microsoft, and Mozilla root programs, while two were used for code signing and trusted by Microsoft. Despite being generated over a year previously, most of the certificates didn't make it into production, with seemingly no evidence of attackers using the keys either.

As it stands, Apple's patch shuts the door on an extremely embarrassing security snafu.