TORONTO, October 29, 2026 —

The deadlines have passed. The exposure has not. Chrome removed the eMudhra root on October 27, and the October 28 date for replacing eMudhra-linked certificates in Amazon Web Services environments has come and gone. Yet Apple says command-line tools included with macOS can still accept the compromised certificates until a future software update, and revocation only protects clients that actually check it. For much of the software behind the browser, neither deadline closed the gap.

The reason is a second chain. Apple confirms that each of the six compromised TLS intermediate certificate authorities has two certificates, twelve in total. One chains to eMudhra's emSign ECC Root CA - G3. The other is cross-signed by Sectigo and chains to AAA Certificate Services. Blocking or removing one root closes one path; the other stays open for any client that still trusts AAA Certificate Services. Apple states that removing the emSign root from the macOS command-line trust file does not block the six cross-signed certificates.

Revocation tells the same story. eMudhra revoked its eight certificates on October 18, and Sectigo revoked the eight cross-certificates on October 19, according to the revocation record compiled by ctlogs.dev. That helps browsers, which check revocation through feeds such as CRLSets and OneCRL. It does not help a client that reads a certificate bundle from disk and never checks revocation. Apple says the macOS command-line tools that check certificates against /etc/ssl/cert.pem, including curl, git, python3, ruby, perl, and openssl, do not check Apple's block or whether a certificate has been revoked.

The same pattern extends beyond one operating system. The ctlogs.dev analysis warns that the larger risk is software that trusts its own or an outdated CA bundle and checks neither Certificate Transparency nor revocation: servers, containers built from older images, language runtimes, and embedded devices. A running container keeps the CA bundle it was built with, and patching the host does nothing until the image is rebuilt and redeployed. The fix named in that analysis is specific: update ca-certificates and Python's certifi, move Go to a patched release, and rebuild container images.

Operators who moved to eMudhra's other root should not treat that move as settled. The Hacker News, quoting the Chrome Root Program, reports that Chrome is reviewing the status of emSign Root CA - G1, while eMudhra has said it will stop issuing TLS certificates from G1 once its transition is complete. No decision to remove G1 has been reported.

"The browser fixes were real, and they were not the whole job," said Sarah Reid, Securetron spokesperson. "A deadline tells you when a vendor stopped trusting something. It does not tell you where trust still lives in your own estate. Every store that never checks revocation, every bundle baked into an image, every runtime with its own roots, is a separate answer, and most teams have never inventoried them."

PKI Trust Manager, Securetron's certificate lifecycle platform, continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise, with a single pane of glass across ADCS, MSCA, Let's Encrypt, DigiCert, and ACME, and full audit trails. It automates issuance, renewal, and monitoring, supports ACME, SCEP, and EST enrolment, and alerts on expiring certificates. Boltron-AI, its AI automation module, maps endpoints, services, and certificate stores, profiles application configurations, and generates onboarding runbooks, so the inventory covers where trust lives, not only which certificates were issued.

"After a compromise like this, the inventory that matters is the trust inventory," Reid added. "Find every store and every client that does not check revocation. The deadlines were the start of that work, not the end of it."

The Community Edition of PKI Trust Manager manages up to 500 certificates free, on premises or as a service. For more information, visit https://securetron.net.

About Securetron
Securetron builds enterprise security infrastructure: PKI Trust Manager with Boltron-AI for certificate lifecycle automation, and AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends. For more information, visit https://securetron.net and https://aifw.io.

Press contact:
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]