Curl on Junian Dev

Using git on Mac with Custom Certificate - eMudhra CA Fix

author@junian.dev (Junian Triajianto) — Fri, 23 Oct 2026 04:00:00 +0700

Previously, I wrote about a temporary fix by making the built-in curl on macOS to use a custom CA bundle after the eMudhra incident. But curl is not the only tool in my terminal that talks to the internet. git does too, especially when I push and pull over HTTPS.

It turns out the system git has the same problem. By default, it still uses the CA file from /etc/ssl/cert.pem, the same file that still trusts the compromised eMudhra CA (by the time I published this article).

Using cURL on Mac with Custom Certificate - eMudhra CA Fix

author@junian.dev (Junian Triajianto) — Thu, 22 Oct 2026 04:00:00 +0700

At the time I wrote this article, there was an incident of a private key compromised by a Certificate Authority, eMudhra. What does that mean for us?

Well, as long as this CA is trusted, anyone can just generate a valid certificate as they wish and can decrypt HTTPS traffic. Meaning they could do a MITM attack without you realizing it.

After the eMudhra incident, most browsers and apps already made an update so this CA is no longer trusted. If you haven’t yet, you should update everything now.