Your macOS Git Still Trusts Compromised Certificates

Apple's bundled git on macOS still trusts compromised eMudhra certificates, and your automated builds may be silently accepting revoked identities.

By the end of this article, you will be able to detect whether your macOS git trusts the compromised certificates, remove them from the system keychain, and verify that your CI environment does not reintroduce them.

Check your git trust store

macOS ships its own copy of git under /usr/bin/git, and it reads certificates from the system keychain rather than from OpenSSL defaults. That means a revoked certificate can still validate if it remains in the login or system keychains.

Run this command to list any eMudhra certificates currently trusted on your machine:

security find-certificate -a -p /Library/Keychains/System.keychain \
  | openssl x509 -noout -subject -issuer 2>/dev/null \
  | grep -i emudhra

If the output is empty, your system keychain is clean. If it prints one or more lines, you have a compromised certificate that git will still trust.

Remove the compromised certificates

Use security to delete every matching certificate by its SHA-256 fingerprint. First, collect the fingerprints:

security find-certificate -a -p /Library/Keychains/System.keychain \
  | openssl x509 -noout -fingerprint -sha256 2>/dev/null \
  | grep -i emudhra

Then loop over the results and delete each one:

for fp in $(security find-certificate -a -p /Library/Keychains/System.keychain \
  | openssl x509 -noout -fingerprint -sha256 2>/dev/null \
  | grep -i emudhra \
  | cut -d= -f2 \
  | tr -d ':'); do
  security delete-certificate -Z "$fp" /Library/Keychains/System.keychain
  echo "Removed $fp"
done

This script removes every certificate whose subject contains "emudhra" from the system keychain. Run it with sudo if you get permission errors.

Verify the fix

Re-run the detection command from the first section. The output should now be empty. You can also test git directly against a known-bad certificate chain:

git ls-remote https://github.com 2>&1 | grep -i "certificate" || echo "No certificate errors"

If git reports no certificate errors, the trust chain is intact.

Prevent CI from reintroducing the certificates

Many CI runners use pre-built macOS images that may still contain the old certificates. Add a verification step to your pipeline:

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  verify-trust:
    runs-on: macos-latest
    steps:
      - name: Check for compromised certificates
        run: |
          count=$(security find-certificate -a -p /Library/Keychains/System.keychain \
            | openssl x509 -noout -subject 2>/dev/null \
            | grep -ic emudhra || true)
          if [ "$count" -gt 0 ]; then
            echo "Found $count compromised eMudhra certificates"
            exit 1
          fi

This fails the build if any compromised certificate reappears in the system keychain.

What can still go wrong

• User keychains: The script above only cleans the system keychain. Users may have imported the same certificate into their login keychain. Run the same check against ~/Library/Keychains/login.keychain-db.
• Homebrew git: If you installed git via Homebrew, it may use its own OpenSSL configuration and ignore the system keychain entirely. Verify with git config --get http.sslBackend.
• Cached TLS sessions: Some tools cache TLS sessions. Restart your terminal or reboot to flush cached connections.

Key takeaways

• macOS git trusts the system keychain, not OpenSSL defaults, so revoked certificates can still validate.
• Use security find-certificate combined with openssl to detect compromised eMudhra certificates.
• Delete them with security delete-certificate -Z and verify with a follow-up scan.
• Add a CI step to fail builds that reintroduce the compromised certificates.
• Check both system and user keychains, and account for Homebrew git's separate trust store.

Source

Apple's git still trusts the compromised eMudhra certificates -- I added working detection and removal scripts, a CI verification workflow, and a checklist of failure modes that the source does not cover.

Support this work

These write-ups are researched and published with no paywall, sponsor, or tracking. If one saved you an afternoon, a small tip keeps them coming. USDT, USDC or USDD · TRC-20 (Tron) TFTNsfyomKrnUutRjBTGVULp19ByW29KbY