苹果阻断eMudhra被泄露私钥的中间CA证书

自2026年10月19日起，苹果公司开始自动拦截由eMudhra运营的、其私钥已被泄露的中间证书颁发机构（CA）所签发的TLS证书 1。这一安全举措源于eMudhra旗下8个中间CA的私钥遭遇泄露事件，其中6个涉及签发TLS证书，另外2个涉及代码签名证书 1。在受影响的TLS中间CA中，共有12张证书出现问题，这些证书既包括直接签发的，也包括通过Sectigo交叉签发的 1。此类密钥泄露构成了严重的安全隐患，攻击者若持有泄露的私钥，即可伪造看似对任何网站均有效的数字证书 1。

尽管Safari浏览器和Mail等应用会自动执行拦截策略，但macOS终端中的命令行工具（如curl和git）在完成系统更新前仍可能接受这些受损证书 1。为此，苹果专门发布了针对系统管理员的指导文件，说明如何通过手动编辑/etc/ssl/cert.pem文件来移除受影响的根CA证书，从而增强系统安全性 1。普通用户通常无需进行额外操作，但对于使用终端的用户而言，可能需要手动从配置文件中删除“emSign ECC Root CA - G3”或“AAA Certificate Services”条目 1。值得注意的是，苹果已于2026年10月23日进一步阻止了“emSign ECC Root CA - G3”证书 1。

Apple began automatically blocking TLS certificates issued by eMudhra intermediate certificate authorities (CAs) on October 19, 2026, following the compromise of private keys belonging to eight of these entities 1. Among the affected infrastructure, six intermediate CAs were responsible for issuing TLS certificates, while two handled code signing certificates 1. The breach poses a significant security risk, as individuals possessing the leaked keys could potentially generate certificates that appear valid for any website 1. In total, 12 TLS certificates are impacted, including those directly issued and cross-signed by Sectigo 1.

While applications such as Safari and Mail automatically intercept these compromised certificates, command-line tools like curl and git may still accept them on macOS terminals until updates are applied 1. To address this gap, Apple released guidance for system administrators recommending the manual removal of specific root CA certificates from the /etc/ssl/cert.pem file to enhance security 1. On October 23, 2026, Apple further blocked the emSign ECC Root CA - G3 1. Consequently, users operating via terminal interfaces may need to manually delete "emSign ECC Root CA - G3" or "AAA Certificate Services" entries, whereas ordinary users require no action 1.