Security flaw in certificate generation

An Indian company, eMudhra, made a critical error in generating private keys for eight HTTPS certificates. Instead of using the standard 384-bit encryption, they used only 8 bits, resulting in just 255 possible key combinations. One of the keys was even as simple as the number 4.

Implications for website security

HTTPS is the standard for secure websites in 2026, and browsers verify a site's certificate to ensure it is valid. The issue with eMudhra is that their certificates appear valid to browsers and operating systems, but because the keys were too simple, anyone could generate a certificate and impersonate a legitimate website, such as a bank or an online store.

Browsers and operating systems respond

Browser companies like Google and Mozilla quickly took action to block the affected certificates. Apple and Microsoft also blocked them, starting on October 19 and 20, respectively. However, this only affects applications that access the internet, such as Safari and Mail, and does not protect tools that use the terminal or internal verification processes.

Vulnerabilities for advanced users

Apple explains that regular users are not at risk if they do not use the terminal. The main concern is for developers and those who use command-line tools, as these users might be vulnerable to attacks that involve replacing external sources with fake certificates. While the risk is low, it is a real concern for those working with command-line interfaces.

Temporary fix provided by Apple

Until an update is released, Apple offers a temporary fix for affected users. This involves backing up the certificate list and removing the problematic certificates using specific terminal commands. Apple also provides the list of blocked certificates and instructions for restoring the backup if needed. The issue is expected to be fully resolved with the next macOS update, likely available later the same day.