A website certificate is supposed to help your software determine whether it can trust a connection. When the keys used to issue those certificates fall into the wrong hands, that trust becomes a dangerous thing to take for granted.
Apple has published a security notice about compromised private keys belonging to eight eMudhra intermediate certificate authorities. Six issue TLS certificates, meaning someone holding those keys could create certificates that appear valid for any website.
Apple began automatically blocking affected certificates on October 19. Safari, Mail, and applications using its networking and security frameworks receive that protection without requiring a software update.
But some Mac command-line tools can still accept them. Apple identifies tools including curl, git, python3, ruby, perl, and openssl that use /etc/ssl/cert.pem. For certificates chaining to roots in that file, these tools do not check Apple’s block or certificate revocation status.
That is an uncomfortable gap for developers and administrators. Protection in the browser does not necessarily mean protection in the tools running alongside it.
Apple says a future software update will address the issue. Administrators can remove relevant root certificates manually now, although that workaround can also prevent some legitimate websites from being verified. Applications with their own certificate lists may need separate attention.
The notice does not report confirmed attacks against users. Still, the takeaway is unsettling: software can appear to validate a secure connection while relying on trust that should already have been withdrawn.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
