The news
The first macOS 27.3 developer beta carries an important security fix that removes compromised eMudhra certificates from the system-wide trust store used by command-line tools. The change edits the /etc/ssl/cert.pem file so that utilities reading it directly no longer treat the certificates as valid. This step closes the remaining gap after Apple blocked the same certificates inside its own apps and frameworks since October 19.
Context
macOS 27.3 itself is not scheduled for public release until December. A macOS 27.2.1 update is expected to deliver the identical certificate removal on a shorter timeline. Until that point, the protection that already exists in Safari, Mail, and other apps built on Apple’s networking and security frameworks continues to apply across macOS, iOS, iPadOS, watchOS, and tvOS. Users who never invoke command-line tools through Terminal or equivalent interfaces receive no additional exposure from the certificates.
The October block was automatic for any software that routes TLS traffic through Apple’s frameworks. Command-line programs that bypass those frameworks and consult the OpenSSL-style certificate bundle instead remained unaffected until the 27.3 beta. The new edit to /etc/ssl/cert.pem brings the two trust stores into alignment.
Details
The certificate removal appears only in the initial macOS 27.3 developer beta. Apple has not published a new support document describing the change; the existing advisory that covered the October framework-level block remains the sole public reference. No indication has been given that further certificates will be removed or that additional modifications will appear in later betas.
The timeline separates the developer preview from the broader rollout. macOS 27.2.1 is positioned as the vehicle that will push the same /etc/ssl/cert.pem edit to current systems without requiring users to install a full .3 release. Command-line utilities that rely on the file—such as certain builds of curl, openssl, or language runtimes that load the system CA bundle—will therefore stop accepting the eMudhra certificates once the update lands.
Apple confirmed that the framework-level block has been active since mid-October and applies automatically on every supported platform. The company has not released details on the precise nature of the compromise beyond the statement that the certificates were no longer trustworthy for TLS web use.
Why it matters
Command-line environments sit outside the protections that Apple can enforce inside its own frameworks. Updating the shared certificate file directly addresses that split without forcing every tool to adopt Apple’s networking stack. The exposure was therefore narrow but real for developers, system administrators, and scripts that perform TLS operations from the shell.
The October framework block limited risk for the majority of users, yet left the /etc/ssl/cert.pem file untouched for weeks. Shipping the fix first in a developer beta while signaling a rapid 27.2.1 release demonstrates that restoring a clean trust store is treated as a priority item rather than a routine maintenance task. Organizations that automate tasks or run build pipelines through the command line now have a concrete path to the corrected state once the point release arrives.
For most Mac users the change will be invisible. For the subset that regularly works in Terminal, the update removes an otherwise persistent source of certificate warnings or, worse, silent acceptance of compromised credentials. The distinction between framework-protected apps and direct file readers is the practical takeaway: two trust stores existed, and both now reflect the same revocation decision.
---
Sources:
No comments yet