GoKawiilApple revokes 8 flawed web certificates, but macOS may still trust them
Apple has revoked eight intermediate web certificates after a script flaw left their private keys guessable by testing just 256 possible values. Apple, Google and Mozilla have all blocked the certificates in their browsers, but Mozilla engineer Dennis Jackson warns that macOS and its built-in curl utility don't check revocation status, so Macs that already trusted these certificates could keep doing so.
GoKawiil's interpretation of the reporting above, not reported fact.
The gap suggests Apple's own operating system lags behind its browser-level protections, leaving a window where a Mac could still accept a fraudulent certificate used to impersonate a legitimate site. Jackson's warning implies this is a systemic issue with how macOS validates certificate trust rather than a one-off bug, though no exploitation has been reported yet. Apple will likely need to issue a security update to close this gap fully.
- Eight intermediate certificates were revoked after a flaw made their private keys guessable.
- Major browsers have blocked the certificates, but macOS itself may not check for revocation.
- No evidence yet of real-world exploitation, and a fix is expected from Apple.
Source: 9to5mac.com — Ben Lovejoy, 2026-10-21
Published there as: “Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.