No compromised CAs are trusted (macOS)

Time to fix

< 5m

What

In October 2026, the private keys of eight eMudhra intermediate certificate authorities were found to be recoverable from their public certificates. Anyone could use them to issue certificates for any website.

Browsers and macOS itself already block these intermediates. But many command-line tools verify certificates against a plain CA bundle file and never check revocation. As long as that file trusts the roots the intermediates chain to, these tools can be fooled.

This check fails when a local CA bundle still contains one of these roots:

emSign ECC Root CA - G3
AAA Certificate Services

Pareto Security looks at /etc/ssl/cert.pem, Homebrew's CA bundles, Nix and nix-darwin CA bundles, and Python certifi bundles in Homebrew, python.org, Anaconda, Miniconda, and pipx installs.

More details: emudhra.we-have-a-problem.com.

How to fix

The check's details in Pareto Security list every file that still contains the affected roots. Fix each one below. ~ means your home folder.

macOS system bundle

The built-in curl, git, python3, perl, ruby, and openssl use /etc/ssl/cert.pem, which macOS has not updated yet. Open Terminal and run this to back up the file and remove the affected roots:

sudo cp -p /etc/ssl/cert.pem /etc/ssl/cert.pem.bak &&
sudo awk '/^(###|===) /{skip=0}
  /^=== .*\/CN=(AAA Certificate Services|emSign ECC Root CA - G3)$/{skip=1}
  !skip' /etc/ssl/cert.pem.bak | sudo tee /etc/ssl/cert.pem > /dev/null

To undo it, run sudo cp -p /etc/ssl/cert.pem.bak /etc/ssl/cert.pem. A macOS update may replace this file again.

Homebrew

Upgrade the ca-certificates formula to version 2026-10-20 or newer. This also fixes openssl@3, which uses the same bundle.

brew update && brew upgrade ca-certificates

Nix and nix-darwin

If you use nix-darwin, add this to your configuration and rebuild with darwin-rebuild switch. This fixes /etc/ssl/certs/ca-certificates.crt.

security.pki.caCertificateBlacklist = [
  "Comodo AAA Services root"
  "emSign ECC Root CA - G3"
];

For the bundle in the default Nix profile (/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt), upgrade nss-cacert once a fixed version is available in your Nix channel.

Python certifi

Upgrade certifi to version 2026.10.19 or newer in every Python environment the check lists.

For an app installed with pipx, replace NAME with the folder name from the path, for example ~/.local/pipx/venvs/NAME/...:

pipx runpip NAME install --upgrade certifi

For other Python installs, run the pip that belongs to that Python:

python3 -m pip install --upgrade certifi

After fixing the files, run checks again in Pareto Security.