Mac users face lingering risk from revoked web certificates
Apple has blocked compromised certificates, but macOS may continue trusting them due to a lack of revocation checks in system utilities.
Key points
- Apple revoked eight intermediate web security certificates after a generation script error exposed private keys.
- Major browsers have blocked these certificates, but macOS system tools may still accept them.
- No evidence currently exists that these compromised certificates are being used in active attacks.
Organisations relying on Mac computers face a potential security gap despite Apple revoking eight compromised web certificates. While Safari and other browsers have updated their blocklists, underlying system utilities on macOS may continue to trust these certificates. This discrepancy could allow malicious actors to impersonate legitimate sites if they exploit the remaining trust path.
Who is affected by this certificate issue?
Any user or organisation operating Mac computers is potentially affected by this vulnerability. The issue stems from intermediate certificates used to verify website ownership. If a script error allowed private keys to be discovered, attackers could theoretically create fraudulent versions of trusted sites. Apple has confirmed that the eight specific certificates involved have been revoked, but the risk persists for system-level connections.
Why do Macs still trust revoked certificates?
According to Bleeping Computer, Apple, Google and Mozilla have blocked the compromised certificates in their respective web browsers. However, Mozilla cryptography engineer Dennis Jackson warns that macOS does not always check for revocation status. Specifically, the built-in /usr/bin/curl utility uses a certificate bundle that lacks revocation checking. If a Mac has already accepted one of these certificates, it will continue to do so without further verification.
How were the certificates compromised?
The vulnerability arose from an error in a script used to generate intermediate certificates. This flaw resulted in private keys that could be trivially discovered by testing just 256 possible numbers. These keys are essential for proving the authenticity of a website. Because the keys were weak, the eight certificates issued using them could be used by scammers to impersonate legitimate domains, such as apple.com, to unsuspecting users.
What is the current threat level?
There is currently no evidence that these compromised certificates are being used in the wild. Apple has taken steps to ensure the vulnerability will not affect any future certificates issued. The company is likely to address the macOS trust issue in an upcoming security update. Until that patch is released, the risk remains theoretical but possible for any Mac that has interacted with these specific certificates.
What affected people can do
Teams should audit their Mac environments for any unusual certificate trusts, particularly in command-line tools. Users should remain vigilant for login prompts on websites that appear legitimate but may be spoofed. Check whether your organisation has a policy for verifying certificate validity beyond browser defaults. Monitor for any unexpected security alerts or warnings from system utilities. Do not ignore certificate errors, as they may indicate an attempt to intercept data. Stay informed about upcoming macOS updates that may resolve this trust issue.
What to do and how to stay safe: Apple
- Verify that all Macs are running the latest available operating system version to ensure browser blocklists are active.
- Monitor network logs for connections to known compromised certificate authorities or unusual SSL handshake failures.
- Educate users to visually inspect website addresses and look for browser security warnings before entering credentials.
- Prepare to apply the next macOS security update immediately upon release to patch the system-level trust gap.
Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these certificates currently being used in attacks?
No, there is currently no evidence that the eight compromised certificates are being used in the wild.
Which Apple products are affected?
Mac computers running macOS are affected because the operating system may continue to trust the revoked certificates.
Have other companies blocked these certificates?
Yes, Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers.
