Your macOS Git Still Trusts Compromised eMudhra Certificates
Apple's bundled git on macOS still trusts compromised eMudhra certificates, risking silent acceptance of revoked identities in CI builds.
Stock photo for illustration only, not from the actual event
- macOS bundles a git version that reads from system keychain instead of OpenSSL.
- Revoked eMudhra certificates may still validate if left in the keychains.
- Terminal commands and scripts are available to find and purge these items.
- You can integrate a verification step directly into your GitHub Actions CI.
The command-line git tool bundled with macOS at /usr/bin/git reads its certificates from the system keychain rather than relying on OpenSSL defaults. Because of this behavior, a revoked certificate can still successfully validate connections as long as it remains stored inside the login or system keychains on your machine.
This design choice means your automated build systems and CI runners might be silently accepting revoked identities without throwing errors. To find out whether your machine is affected, you can execute a specific terminal command to list any eMudhra certificates currently trusted by your system.
The fact that macOS Git references the operating system's Keychain instead of a standard OpenSSL store is a crucial distinction that developers must monitor. Standard system updates or legacy keychain configurations can preserve revoked certificates at the machine level, creating a hidden vulnerability in automated development and deployment pipelines.
To perform the detection check, run the following command in your terminal:
- Execute
security find-certificate -a -p /Library/Keychains/System.keychain | openssl x509 -noout -subject -issuer 2>/dev/null | grep -i emudhrato scan. - If the output is empty, your system keychain is completely clean.
- If lines appear, you have a compromised certificate that git continues to trust.
Stock photo for illustration only, not from the actual event
If the scan detects lingering certificates, you can purge them using the security tool by targeting their SHA-256 fingerprints. Collect the fingerprints first and then loop through them to delete each match from /Library/Keychains/System.keychain, using sudo if permission errors occur.
Re-running the initial detection command should yield an empty result once the cleanup is complete. Additionally, you can test git against a remote repository using git ls-remote https://github.com to verify that your certificate trust chain remains intact and error-free.
Since many CI runners utilize pre-built macOS runner images that might still contain legacy certificates, it is best practice to add a verification step into your pipeline configuration—such as a GitHub Actions workflow step—that counts remaining eMudhra certificates and fails the build if any are detected.
Source: Dev.to
Found something wrong in this article? Report an issue with this article
Comments
Leave a Comment