Four no more: macOS 27.3 kills off those stupidly insecure certificates
appleinsider.com Nov 5, 2026

Four no more: macOS 27.3 kills off those stupidly insecure certificates

AI-summarised brief · reviewed before publication

Apple released macOS 27.3 developer beta 1, which permanently blocks eight eMudhra certificates that were found in October to use absurdly short cryptographic keys, some as short as a single digit. The certificates, issued in April 2025, had been trusted for TLS and code‑signing across Apple, Chrome, Microsoft and Mozilla root stores. Earlier patches stopped their use on iOS, iPadOS and other platforms, but macOS’s curl tool ignored revocation data, leaving older Macs vulnerable. The new update revokes trust even for certificates previously added manually, and Apple also posted guidance for administrators to delete the roots without waiting for an OS upgrade. A public release is slated for December, with a possible interim 27.2.1 fix in the upcoming rollout later.

💡 Why It Matters

  • · By finally revoking the bogus roots on macOS, Apple eliminates a rare but glaring trust‑chain flaw that could have been exploited to spoof secure connections or maliciously sign software, restoring confidence in the platform’s certificate ecosystem.