If you run git clone https://... on a stock Mac today, Apple's git still trusts certificates signed with the compromised eMudhra intermediate CA keys, keys that anyone can recover from the public certificates. Firefox and Chrome blocked those certificates on 17 October. Safari followed. /usr/bin/git did not, and as of 28 October it still trusts them .

Then macOS 27.2 shipped on 26 October without a fix, and the update undid the /etc/ssl/cert.pem workaround people had already applied. If you patched your Mac last week, check again.

Checking your own machine takes about a minute, and the fix I use is further down. Skip the Keychain advice that's going around; it doesn't help here. Homebrew git also turned out not to be the escape hatch people assumed.

What happened with the eMudhra intermediate CAs

eMudhra generated the private keys for eight intermediate CA certificates so badly that the keys can be recovered from the certificates themselves .…