At the time I wrote this article, there was an incident of a private key compromised by a Certificate Authority, eMudhra. What does that mean for us?
Well, as long as this CA is trusted, anyone can just generate a valid certificate as they wish and can decrypt HTTPS traffic. Meaning they could do a MITM attack without you realizing it.
After the eMudhra incident, most browsers and apps already made an update so this CA is no longer trusted. If you haven’t yet, you should update everything now.
It’s all good except for the built-in curl on macOS.
By default, the system curl on macOS still uses the CA file from the system /etc/ssl/cert.pem.
You can check it with this command:
/usr/bin/curl -v https://example.com 2>&1 | grep CAfileThe command output on my Mac was like this:
$ /usr/bin/curl -v https://example.com 2>&1 | grep CAfile
* CAfile: /etc/ssl/cert.pemUntil this article is published, there is no official update yet from Apple. But you can still protect the system cURL from using the compromised CA and using the latest Certificate store file from Mozilla. Here’s how.
UPDATE 2026/10/28: the developer tools Apple ships with macOS like
gitandcurlstill trust the compromised certificates, and macOS 27.2 undid user-applied fixes.
UPDATE 2026/10/25: if you prefer to remove eMudhra manually, Apple now provides an official guide on their support page.
eMudhra Compromised Test
Before we update the cURL CA bundle file, let me show you how to test if your macOS still trusting the compromised eMudhra CA.
If you execute the following command from the terminal and get a 200 HTTP response, that means you’re compromised.
/usr/bin/curl https://dv-g3b-emudhra.we-have-a-problem.comHere’s what it showed on my MacBook:
$ /usr/bin/curl https://dv-g3b-emudhra.we-have-a-problem.com
Your client successfully connected to the site. That's bad!It shows a response from the server with a “Your client successfully connected to the site. That’s bad!” message, which means connected successfully, which means my system cURL still trusts eMudhra CA, which means a bad thing and I need to fix it.
In the next section, I’ll show you how to use the macOS system cURL with the latest CA file bundle from Mozilla.
Using curl with a Custom CA Certificates File
Now that I know my macOS cURL still trusts the compromised CA, while waiting for Apple to make an official fix, I will use the latest and safest CA certificate store from Mozilla.
This certificate store can be installed easily using the Homebrew package manager.
brew install ca-certificatesNow we need to make sure that the built-in curl uses this latest certificate store from Mozilla to trust.
To do that, we need to set the SSL_CERT_FILE or CURL_CA_BUNDLE environment variable.
Edit your ~/.zshrc file and add the following line.
export SSL_CERT_FILE="$(brew --prefix ca-certificates)/share/ca-certificates/cacert.pem"
export CURL_CA_BUNDLE="$SSL_CERT_FILE"This will point curl to use the certificate store defined by SSL_CERT_FILE or CURL_CA_BUNDLE for each terminal session.
Testing curl Connecting to Compromised CA
Now that we have already configured curl using the latest certificate store, we can retry the test.
Start a new terminal session and do the exact same test above.
$ /usr/bin/curl https://dv-g3b-emudhra.we-have-a-problem.com
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
Establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Built-in curl: HTTP 000This time, I got an ‘SSL certificate problem’ message, which is great news because we’re not supposed to trust this compromised certificate any longer.
Final Thoughts
Anyway, that’s all I can write for today. The world we know is no longer there. Stay vigilant with all these vulnerabilities.
As usual, if you have any questions or a better method, leave a comment below. Thanks for reading, and see you next time!