Apple blocks a set of compromised, weak security certificates on iPhone and iPad, preventing websites from using them to impersonate legitimate domains. The certificates were issued by certificate authority eMudhra, and researchers say their private keys are unusually easy to reconstruct, enabling attackers to create fraudulent certificates that some software could trust.
Reporting ties the blocks to Mozilla cryptography engineer Dennis Jackson and says Apple introduced the changes on October 19. One article notes the issue surfaced after disclosure on October 17, when the certificates were revoked. Another outlet adds that protections rely on Apple’s certificate checking and that the attack path may be more limited on Safari and other major browsers, though it remains unclear whether attackers exploited other software.
Coverage also diverges on the remaining risk. One source says the approach is straightforward, while another warns that macOS may still trust the compromised certificates in some scenarios because it does not check revocation. Overall, outlets agree Apple has blocked the affected certificates, but differ on how thoroughly the change covers macOS behavior.
