Apple blocks risky certificates that could have let attackers fake websites

Apple has blocked a set of compromised digital certificates from an Indian company called eMudhra, closing a security hole that could have allowed attackers to pretend to be legitimate websites. For most people who own an iPhone, iPad, or Mac, nothing needs to be done—the protection is already in place automatically.

Earlier this month, a security researcher discovered that eight certificates issued by eMudhra had extremely weak security keys. In simple terms, the secret codes meant to keep those certificates trustworthy were so poor that almost anyone could figure them out. That meant an attacker could potentially create fake certificates for real websites and trick people into thinking they were on a legitimate site. So far, there is no evidence that anyone actually used the weakness to carry out attacks.

These certificates had been trusted by major web browsers, including Safari, Chrome, Firefox, and Edge. After the problem came to light on October 17, browser makers and operating system companies moved quickly. Apple began blocking the affected certificates on October 19. The block applies automatically to Safari, Mail, and most apps on Apple devices, so no software update or settings change is required for ordinary users.

There is one exception. Some tools that developers and system administrators use on a Mac — such as certain command-line programs may still accept the certificates until Apple releases a future macOS update that closes the gap completely. Apple has not given a date for that update. In the meantime, people who rely on those tools and want extra protection can take optional manual steps described in Apple’s support document. Most Mac users who do not use those tools do not need to do anything.

Google, Mozilla, and Microsoft also blocked the certificates on their platforms within days of the report. eMudhra itself revoked the certificates and has since said it is leaving the business of issuing global website security certificates. The company has stated that the problem came from a mistake during the process of creating the certificates, that its systems were not hacked, and that no customer data was stolen.

The incident shows how quickly major technology companies can respond when a serious certificate problem is found, while also highlighting that some specialized tools on computers can take longer to fully protect. For the vast majority of Apple users, the risk has already been addressed.
‎
More info about this issue via Apple Support’s “About the compromised eMudhra intermediate CAs” document here.

‎

.

Source link: https://macdailynews.com/2026/10/26/apple-blocks-risky-certificates-that-could-have-let-attackers-fake-websites/