Apple blocks flawed eMudhra digital certificates in macOS beta update

Apple has integrated a comprehensive block on digital certificates issued by Indian firm eMudhra into the latest macOS 27.3 developer beta. This move follows the discovery of severe cryptographic flaws, where certificates were generated using excessively short and insecure private keys, some as simple as the digit '4'.

The vulnerability, which surfaced in October 2026, prompted industry-wide action. Google and Mozilla moved to blacklist the certificates shortly after the disclosure, while Apple implemented similar protections for iOS and iPadOS. The implementation in macOS was previously delayed by technical hurdles related to the operating system's built-in curl tool, which failed to verify certificate revocation status.

While this update addresses the macOS vulnerability, industry regulators have noted that eight specific certificates were compromised, six used for TLS encryption and two for code signing. Reports indicate that most of these certificates were not widely deployed, and there is no current evidence suggesting they were exploited by malicious actors.

Following the breach, eMudhra confirmed it would exit the global SSL/TLS certificate market, citing internal procedural failures. Apple’s latest move serves as a final step in neutralizing the risk across its ecosystem before the official software release scheduled for December.