It seems that Apple is not planning to update the file /etc/ssl/cert.pem so that the compromised intermediate certificates by eMudhra are removed any time soon.
Instead, users (mostly developers that use the Terminal aka command line interface (CLI)) must clean up the file themselves.
Here is the approach (as of 2026-11-04):
Check if you are vulnerable. If this command yields no output, you do not need to proceed.
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/cert.pem | openssl pkcs7 -print_certs -noout | grep -E 'emSign ECC Root CA - G3|AAA Certificate Services'
Backup the file (only works if you do not yet have a backup)
[ -e /etc/ssl/cert.pem.orig ] || sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.orig
Perform the surgery:
t=$(mktemp) && awk -v s='=== /C=IN/OU=emSign PKI/O=eMudhra Technologies Limited/CN=emSign ECC Root CA - G3' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"
t=$(mktemp) && awk -v s='=== /C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services' '/^(===|###) /{skip=0} $0==s{skip=1} !skip' /etc/ssl/cert.pem > "$t" && [ -s "$t" ] && sudo install -m 0644 -o root -g wheel "$t" /etc/ssl/cert.pem; rm -f "$t"
Unfortunately, Apple writes:
A macOS software update can replace /etc/ssl/cert.pem with Apple's version. Until you install the software update that includes Apple's changes, run the command in step 4 after each software update. If it lists a root CA certificate that you removed, the update replaced the file. Delete the old backup using
sudo rm /etc/ssl/cert.pem.orig, then repeat these steps. After you install the update that includes Apple's changes, you don't need to repeat these steps for the command-line tools included with macOS or the Xcode Command Line Tools.
