eMudhra mitigation not working reliably, can't be fixed on iOS and iPadOS

Question

eMudhra mitigation not working reliably, can't be fixed on iOS and iPadOS

MacOS, iOS, iPad OS, all version 27.0.1.

The eMudhra revocation worked yesterday morning, blocking access to all the test pages at: https://emudhra.we-have-a-problem.com.

By the end of the day my browsers (Safari and Orion) were able to access all the pages chained to emSign Root with C=NL. The other pages remained inaccessible (ie the eMudhra mitigation was working properly). So my computers and mobile devices were less secure at the end of the day than at the start. My suspicion is that the OSCP servers were overloaded and iOS/MacOS take a lack of response to mean "don't revoke", but I can't be certain.

On the Mac I manually set the Root certificate for emSign to Not Trusted (using Keychain Access) and that prevents access successfully.

How do I do this on my iOS ? More realistically, why hasn't Apple removed the Root certificates, instead only revoking the Intermediates? The company has announced it is stopping certificate operations and in any case has shown that it can't be trusted.

iPhone 17 Pro, iOS 27

Posted on Oct 22, 2026 10:57 AM

Reply

Answer 1

Top-ranking reply

TooManyLegs

Level 1

14 points

Oct 22, 2026 12:25 PM in response to Robert Rainthorpe

Running ios 27.0.1 on iphone SE, going to https://emudhra.we-have-a-problem.com and running the web client test from safari, it was telling me that I have trusted 3 of the intermediates, and it was telling me that from yesterday evening. Just now it tells me I have trusted only one (CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL).

When will the trust store be updated, and how does it get updated?

Currently under Certificate Trust Settings I am seeing

Trust Store Version 202607300

Trust Asset Version 1013

That is old, when will we see a Trust Store Version with removed vulnerable certs, and why is Apple not being more transparent about this?

Interestingly or not, the Me Too button on this page just keeps circling the wagon, so I'm not sure this all helps.

As a reply to you, Robert, it's only confirmation you're not alone.

As someone who has done support on many duplicate tickets, I thought I would piggy back, sorry.

Reply

Answer 2

LotusPilot

Level 10

333,396 points

Oct 22, 2026 3:10 PM in response to TooManyLegs

TooManyLegs wrote:

When will the trust store be updated, and how does it get updated?

Currently under Certificate Trust Settings I am seeing

Trust Store Version 202607300

Trust Asset Version 1013

The iOS/iPadOS Certificate Trust Store is embedded within the OS - and is periodically updated by Apple along with iOS/iPadOS.

As to when Apple will next update the Trust Store is unknown; such u-dates are not pre-announced. That said, given the scale of this debacle, we might reasonably anticipate that an update might be issued sooner rather than later.

Reply

Answer 3

Oct 22, 2026 3:10 PM in response to Robert Rainthorpe

Currently (five hours after I posted the question), all my iOS and iPadOS browsers are working correctly and blocking access to the intermediate certificate test pages.

Don't know if this is a permanent fix, certainly the Trust Store hasn't changed version (still 2026073000, 1013). May just be a change in load on the OSCP servers, if my theory about overload is valid, in which case the problem may return.

Reply

Answer 4

raduking

Level 1

0 points

Oct 22, 2026 4:29 PM in response to Robert Rainthorpe

Is running a `curl *** in your terminal blocked?

[Edited by Moderator]

Reply

Answer 5

Oct 22, 2026 4:23 PM in response to raduking

I've patched curl, python, mise, homebrew etc. It's just the OS-level browser stuff that wasn't working correctly.

Reply