What happened?

A post that reached 519 points on Hacker News claims that Git on macOS still trusts compromised eMudhra certificates. According to the headline, the trust chain has not been updated even ten days after the issue surfaced.

Why it matters

Git verifies a server's identity with certificates when fetching repositories over HTTPS. When a certificate authority (CA) is compromised or misbehaves, certificates signed by that CA can be used on malicious servers, opening the door to man-in-the-middle attacks.

Technical background

macOS keeps trusted root certificates in the system keychain. When tools such as Git for macOS rely on this system, removing a root certificate propagates through a system update. The post implies this process is moving slower than expected.

What developers should do

  • Check your Git version and macOS updates.
  • In corporate environments, review certificate pinning and trusted CA lists.
  • Consider removing suspicious certificate authorities from system security settings.