Apple automatically blocks compromised eMudhra TLS certificates in Safari, Mail and related apps, but warns that some macOS command-line tools need separate attention. Tools such as curl and git that use the system certificate file may still accept affected certificates until a future update. Most users do not need to edit files; administrators can follow Apple’s guidance to identify affected tools and trust stores. Manually removing roots can also affect validation of legitimate sites, so the scope matters.