About the compromised eMudhra intermediate CAs

Apple is blocking 12 certificates from six eMudhra intermediate CAs whose private keys were compromised, plus the emSign ECC Root CA - G3 since 23 October. Safari, Mail and apps using Apple's frameworks are covered automatically. Command-line tools such as curl, git, openssl and python3 read /etc/ssl/cert.pem and skip Apple's block until a future macOS update. Administrators can remove the emSign root and AAA Certificate Services from that file, which may break verification of some unaffected sites. Apple's page is the only source, and the claims are unverified elsewhere.