Removal of AAA Certificate Services from the Apple Root Program

By Sectigo Team

In the week of November 2nd, 2026, Apple is releasing an update that will remove the AAA Certificate Services Root CA from parts of the Apple MacOS operating system.

This root was already removed from Google Chrome and Mozilla trust stores in April of 2025, and Microsoft in October of 2026.

The removal by Apple is done as an emergency measure in response to an incident affecting eMudhra, for which an advisory was previously posted on https://www.sectigo.com/resource-library/advisory-on-compromised-emudhra-intermediate-certificates. As the AAA Certificate Services Root CA had been used to cross-sign eMudhra CAs, the decision was made by Apple to remove any trust anchors that could potentially lead to the trust in maliciously issued certificates.

For the moment, the release will be limited to a removal of the Root CA from the underlying operating system. We expect that a full removal from Keychain will follow soon after. As a result, it is possible that command line applications already see the Root CA Certificate as having been removed, but Safari may not yet.

This removal also marks the next phase in the removal of legacy Root CAs from trusted root programs. As already outlined in both https://www.sectigo.com/resource-library/changes-to-root-ca-hierarchies-and-trust-status and https://www.sectigo.com/resource-library/enhancements-to-root-ca-and-hierarchies, trusted root programs have begun the removal of older Root CAs from their root stores.

Certificate issuance by this Root CA was already halted by Sectigo several years ago, in anticipation of these deprecations. Sectigo has however issued cross-signed CA certificates from this Root CA, to support older, legacy devices, while allowing certificates to be issued from modern hierarchies.

The removal of the AAA Certificate Services Root CA is not expected to lead to any issues with customer devices or infrastructure, unless any form of CA or Public Key Pinning to the specific Root CA is in place.

If you do utilize pinning, we strongly recommend removing this practice. Certificate pinning can, and has, led to severe critical infrastructure incidents and downtime. For more inquiries around this, please reach out to [email protected]