Apple has blocked a group of compromised security certificates after researchers discovered they were protected by extraordinarily weak cryptographic keys, potentially allowing attackers to impersonate legitimate websites.
The certificates were issued by eMudhra, an Indian certificate authority whose credentials are trusted by default across Apple platforms and major browsers.
An investigation into the affected certificates found that their private keys were all numbers smaller than 256.
For comparison, properly generated cryptographic keys of this type should come from a range containing roughly 10⁷⁷ possible values.
That makes the compromised keys exceptionally easy to recover, undermining the security protections those certificates were supposed to provide.
Why These Certificates Were Dangerous
Digital certificates help browsers and other software verify that a website is genuine and establish encrypted connections.
Their security depends on private keys being practically impossible to guess. When those keys are weak, attackers may be able to impersonate trusted websites using fraudulent credentials.
In this case, the extremely small key values could potentially allow someone to recover the private keys almost instantly.
Apple introduced blocks for the affected certificates on October 19, preventing software that uses its system certificate validation from trusting them.
Mozilla and Google have also taken steps to block the compromised credentials.
Safari Users Had Additional Protection
Fortunately, Safari and other major browsers already had additional certificate verification measures that would have prevented this particular attack.
The bigger concern involves software that relies directly on operating system certificate stores without those extra browser protections.
On Macs, developer tools such as curl, git, Python, Ruby, and Perl may use a separate certificate file that Apple’s system-level restrictions don’t automatically update.
That means some Mac users could remain exposed even after Apple’s security changes.
Technical guidance for checking and removing the affected certificates includes tests to determine whether a system still trusts them, along with instructions for manually updating the certificate file used by those tools.
There is currently no confirmation that attackers exploited the weak certificates before the blocks were introduced.
For most people browsing with Safari, the existing protections and Apple’s subsequent certificate blocks substantially reduce the concern.
Developers who regularly use command-line networking tools, however, may need to check their certificate configurations separately.
