alt Hacker NewsAccording to this blog [1], it has now been almost 5 days since a researcher reported to Apple that the eMudhra CA certificates were compromised.
As I am writing, my iPhone 15 Pro is still accepting certificates signed by these compromised CAs. The device is "up to date", yet is still running Trust Store Version 2026073000. When I check at [2], certificates issued by 3 eMudhra Intermediate CAs are still being trusted!
Google Chrome revoked these certificates in 1 hour 40 minutes, Mozilla in just under 4 hours.
I am so astonished by how much Apple has failed here. There are potentially huge swathes of people completely oblivious that their phones are susceptible right now to being man-in-the-middle attacked.
Why does the iPhone not utilise a CRL list? Why does it take Apple 5+ days to do what Chrome did in under 2 hours.
It's a similar story for my MacBook, but at least there my Chrome browser _does_ use a CRL (the same can't be said for all the programs installed, however).
[1] https://fenko.nz/blog/emudhra-ca-compromise/#what-happened-i...
Replies
iOS absolutely uses a CRL, and Apple has revoked the eMudhra certs as of this morning: https://www.macrumors.com/2026/10/22/apple-blocks-certificat...
Do you have battery saving mode on? I think it blocks the background process that updates. I had the same issue but turning it off and waiting 1 minute started blocking all the certificates. This is for iPhone 13.
> Your browser trusted 4 of 14 compromised certificate chains.
Just now on M1 Pro Safari.
On M1 Prp Firefox: none.
On iPhone 17: Safari: none, Firefox: none.
My iPhone 12 is fine, so its not that Apple has done nothing, but there must still be issues with getting this to all devices?
I'm pretty sure Apple does use CRLs, but for some reason your phone has a problem fetching them. Yesterday my iPhone SE running iOS 15.8.8 did connect to the sites, but refused to connect about 30 minutes later.
My previously working, then broken iOS and iPadOS browsers now work and have done for the last hour. Who knows why.
My iPhone 13 has all those certs blocked.
“Did not connect” for me, from your second link, on iOS 27.
I pointed this out yesterday and people thought I was nuts:
https://news.ycombinator.com/item?id=50189521
I suspect Apple published no update and is relying on the CA's CRL and/or OCSP to do its job. But it's rate-limited, the connections time out, and iOS is hard-coded to soft-fail.
Like you my trust store is months old.
That said, I found separate installs of Firefox and Microsoft Edge that accepted *all* the bad certificates without a care.
The only browser that consistently rejected all of them was — you guessed it — Internet Explorer. A browser so old it couldn't even run the test properly but it did what it needed to and blocked all the servers.