Apple distinguishes browser certificate blocks from command-line trust
Apple confirms that some macOS command-line tools can still accept compromised eMudhra certificates even though Safari and apps using Apple’s networking frameworks block them. Tools such as curl and git can use a separate certificate file that bypasses those blocks. Apple documents an administrator workaround and warns that macOS updates can replace the edited file until its planned software fix arrives.
Apple Support · Oct 29, 2026
Why it matters
Developers and CI operators need to check the trust store their actual tools use, rather than infer protection from browser behavior.
More context
The October 29 guidance materially extends earlier incident coverage. Apple explains an optional root-removal procedure with backup and verification steps. Review the official instructions and affected toolchain before making a managed change; applications with bundled trust stores need separate checks.
Keep in mind
Removing roots can also prevent otherwise legitimate sites from validating. Apple describes the command-line fix as future work; no specific shipping version is established here.
Original read