Apple's git still trusts the compromised eMudhra certificates

Original Article ↗ Hacker News Discussion ↗

Apple’s handling of the compromised eMudhra TLS certificates is under fire because macOS still ships a CA bundle in `/etc/ssl/cert.pem` that trusts them, leaving command‑line tools like git, curl, Python, and OpenSSL vulnerable even though Safari and other GUI apps were quickly protected via Apple’s own trust framework. Commenters criticize the existence of two separate system trust stores on macOS, Apple’s slow and manual remediation guidance, and the fact that OS updates can silently undo user-applied fixes. The incident also highlights deeper problems with fragmented certificate management across operating systems, containers, and languages, and renews calls for better centralized revocation and trust-store design.

What’s actually broken

  • Issue is broader than Git: many macOS command‑line tools (git, curl, python3, ruby, perl, openssl, etc.) use /etc/ssl/cert.pem, which still includes roots that allow chains through compromised eMudhra intermediates.
  • GUI apps using Apple’s Security/Keychain stack (Safari, typical Mac apps) were updated quickly and do not trust the bad chain.
  • macOS effectively has two independent trust stores: Keychain for Apple APIs and /etc/ssl/cert.pem for Unix‑style tools, creating divergence and confusion.

Apple’s response and shortcomings

  • Apple published an official support article explaining how users can manually edit /etc/ssl/cert.pem to remove certain roots (and optionally related Sectigo roots).
  • Several commenters find this unacceptable: users must run sudo shell commands, changes are undone by OS updates (e.g., macOS 27.2 restored the bad certs), and no rapid automated fix has shipped.
  • Some speculate Apple treats CLI tools as second‑class and is slow or unwilling to use its “background/rapid” security update channels for Unix components.

Workarounds and ecosystem reactions

  • Suggested mitigations:
    • Manually follow Apple’s instructions to edit /etc/ssl/cert.pem.
    • Use Homebrew or MacPorts versions of curl and OpenSSL, which ship their own CA bundles; Homebrew is updating git to stop using the system bundle.
    • Prefer SSH for Git remotes instead of HTTPS (though SSH has its own trust issues).
  • Scripts and one‑liners to automate Apple’s instructions are shared; some warn against normalizing copy‑pasting random sudo commands.

Security impact and severity debate

  • Many argue it’s a serious MITM risk, especially on public Wi‑Fi or compromised routers; tools like mitmproxy already support abusing the bad chain.
  • Others downplay it, saying attackers must control local networks and widespread exploitation would be detectable now that many devices are patched.
  • Multiple comments note broader PKI problems: fragmented CA stores (per app, per container, per language), weak or unused revocation mechanisms, and the difficulty of cleanly distrusting intermediates when only roots are packaged.

Meta: Apple, Linux, and trust models

  • Some use this as a reason to favor Linux; others counter that all platforms have had serious security failures.
  • There is criticism that Apple markets itself as security‑first yet failed to ship a prompt, centralized fix for its own Unix tools.