Is my Mac affected by the eMudhra certificate incident?

What happened#

Eight intermediate certificate authority (CA) certificates run by eMudhra had private keys that could be recovered trivially. Anyone holding such a key could issue certificates that software trusting these intermediates would accept. They chain to emSign Root TLS CA - G3 and emSign ECC Root CA - G3, and were also cross-signed by Sectigo AAA Certificate Services, so a certificate store that trusts any of those roots could accept them until it blocks the eight.

CERT-In's advisory CIAD-2026-0050 of 21 October says the public disclosures don't establish confirmed malicious use of the keys as of that date.

Safari, Chrome and Firefox: already blocked#

So for browsing, there's nothing to change. Keep your browsers and macOS up to date as usual.

What isn't covered yet: tools with their own certificate bundle#

Some developer tools don't ask macOS which certificates to trust. They read a list that ships inside the tool, and they keep trusting the eight intermediates until that list is updated. These are the ones with a fixed release:

Python: check and update certifi#

Every Python environment has its own copy of certifi, so check the one each project uses. Activate the project's virtual environment first, then:

python3 -m pip show certifi
python3 -c "import certifi; print(certifi.__version__, certifi.where())"

WARNING: Package(s) not found: certifi means that Python has no certifi, so there's nothing to update in it. To list the certifi copies in your home folder, with the version in each folder name:

find ~ -type d -name "certifi-*.dist-info" 2>/dev/null

macOS may ask whether Terminal can open folders such as Documents or Desktop while this runs. Any folder name below certifi-2026.10.19.dist-info is an older copy. Update it in the environment it belongs to:

# pip, inside the activated virtual environment
python -m pip install --upgrade certifi

# uv
uv lock --upgrade-package certifi
uv sync

# Poetry
poetry update certifi

If a requirements.txt pins an older version, change the line to certifi==2026.10.19. Homebrew's Python refuses pip install outside a virtual environment, so update certifi inside each environment rather than globally.

Node.js#

node -v

Node.js 26.12.1, 24.22.1 and 22.23.4 update its built-in certificate list for this incident, and they're the same versions as the Node.js security release of 21 October. How to update depends on how Node was installed: see checking and updating Node on a Mac.

Go, and programs built with Go#

Go 1.27.3 and 1.26.10 carry the fix. A Go program contains the Go version it was built with, so updating Go isn't enough: rebuild each program, and reinstall the Go tools you installed with go install.

go version
brew upgrade go
go version ~/go/bin/*

go version followed by file names prints the Go version each program was built with. For one built before the update, run its go install command again, for example go install golang.org/x/tools/gopls@latest. If you installed Go from go.dev rather than Homebrew, download the new installer there instead of running brew upgrade go.

Homebrew and Composer#

brew list --versions ca-certificates
brew update
brew upgrade ca-certificates

For PHP projects that use Composer's certificate bundle, run these in the project folder:

composer show composer/ca-bundle
composer update composer/ca-bundle

The faster way: Package Watch in iKnowMyMac#

Package Watch in iKnowMyMac checks the Python packages in every environment on your Mac, including certifi, against published advisories.