eMudhra certificates: audit TLS trust in Mac tools

Created October 24, 2026 · Apple publication analysed: October 23, 2026 · Source accessed October 24, 2026

Following the eMudhra advisory, we recommend that IT teams review TLS trust in their Mac automation. This guide proposes an acceptance process: identify tools, test business workflows and retain validation evidence before expanding deployment.

1. What Apple confirms

Apple has automatically blocked compromised certificates since October 19. Some Mac tools, including curl and git, may still accept them through /etc/ssl/cert.pem pending an update. Software with its own root list requires a check with its vendor.

2. Inventory workflows as well as devices

We recommend a record for each automation: owner, affected Macs, actual executable, installation source, version, TLS configuration and destinations. Include support scripts, package downloads and development tasks. Record the execution context too: a task launched by MDM should be validated in that context.

Define evidence of successful operation

For each workflow, record the expected outcome: a verified download, repository access or retrieval of a test artefact. Use controlled destinations and test accounts. Avoid judging a script’s security solely from successful browsing in Safari.

3. Control any temporary measure

Apple offers an optional change to the trust file; it can affect legitimate sites and be replaced by a macOS update. Consult the official procedure before intervening.

Run a pilot with stop criteria

Our recommendation: have the security owner approve the decision, retain the initial state and test a small representative group. Then check the inventoried workflows, business access and results after restart. If something breaks, pause expansion and have the remediation decision reviewed. Do not work around the issue by disabling TLS validation.

4. What changes for a Belgian or French business

For an SME, start with service-provider scripts and development Macs. For a mid-sized business, large enterprise or public body, we recommend an owner for each automation chain and validation by user group. Test access specific to Belgian and French sites: a pilot should represent their workflows, proxies and repositories.

Keep a shared change record for the teams: scope, decision, results, exceptions and next review. This record supports service delivery and internal follow-up; on its own, it does not demonstrate regulatory compliance.

5. Underside analysis: track trust at workflow level

Our view is that device inventory should connect to the automation that keeps each workstation running. We recommend using Jamf or MDM to target the pilot and collect results, then asking the service owner to validate operation. A successful command status alone does not demonstrate that the business process works.

Continue with our analysis of TLS and MDM requirements and our Jamf and Apple management guide.

Source : Apple — About the compromised eMudhra intermediate CAs.