Apple blocks eight rogue web certificates, but Mac vulnerability remains

Revoked certificates could have allowed website impersonation, but macOS may still trust them

By LineZotpaper

Published21 October 2026

Read Time1 min

Apple has blocked eight web security certificates that could have been exploited by scammers to impersonate legitimate websites, but a cryptography engineer has warned that Macs may continue to trust the compromised certificates because macOS does not check revocation status.

The issue involves intermediate certificates used to prove website ownership. An error in the script generating these certificates resulted in private keys that could be discovered by testing just 256 possible numbers. Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers, and the certificates have been revoked.

However, Mozilla cryptography engineer Dennis Jackson warns that Macs remain vulnerable. According to Jackson, macOS's built-in trust store does not check revocation information, meaning any Mac that has already accepted one of the compromised certificates will continue to do so. Additionally, the /usr/bin/curl utility on macOS may also continue trusting them for the same reason.

There is currently no evidence that the certificates have been used in the wild. Apple is expected to address the issue in an upcoming security update.

Analysis

Why This Matters

The compromised certificates could have enabled scammers to impersonate trusted websites, potentially leading to phishing attacks or data theft.
The vulnerability highlights a gap in macOS's security posture compared to other platforms, leaving Mac users exposed until a system-level fix is applied.
The incident underscores the importance of robust certificate revocation checking, a feature macOS currently lacks for its trust store.

Background

Web security certificates are a cornerstone of online trust. Intermediate certificates, issued by trusted root authorities, prove that a website is genuine. An error in a script used to generate these certificates led to predictable private keys, making it trivial for attackers to create fraudulent certificates. Apple, Google and Mozilla quickly revoked the affected certificates and blocked them in their browsers. However, the macOS operating system does not automatically check certificate revocation lists, leaving a potential window for exploitation if the certificates are already cached.

Key Perspectives

Apple: The company has blocked the certificates in Safari and is expected to release a security update to address the macOS vulnerability. Dennis Jackson (Mozilla): The cryptography engineer warned that macOS may still trust the compromised certificates because revocation checking is not performed, and the curl utility may also be vulnerable. Current status: There is no evidence of the certificates being used in the wild, and Apple is likely to issue a fix.

What to Watch

An upcoming macOS security update from Apple that may fix the certificate revocation checking issue.
Reports of the compromised certificates being used in phishing campaigns or other attacks.
Potential industry discussion on standardizing revocation checking across operating systems.

Sources

Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains · 9to5Mac

Checked

12 claims in this story checked against 1 source: 7 supported.

Show each claim

Partly supportedApple blocked eight “rogue” web certificates, but the Mac vulnerability remains.9to5Mac: “Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites. However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates”
SupportedThe revoked certificates could have let scammers impersonate legitimate websites, while macOS may still trust them.9to5Mac: “Apple has blocked eight web security certificates that could have been used by scammers to impersonate legitimate websites. However, one cryptography engineer has warned that Macs may continue to trust the compromised certificates”
Partly supportedApple, Google and Mozilla each blocked the certificates in their respective browsers.9to5Mac: “Bleeping Computer reports that Apple, Google and Mozilla have each blocked the compromised certificates in their respective web browsers.”
SupportedThe compromised certificates have been revoked.9to5Mac: “The eight compromised certificates have now been revoked”
SupportedThe certificates were intermediate certificates used to prove website ownership.9to5Mac: “The issue concerns what are known as intermediate certificates. These are used to prove ownership of a website”
SupportedAn error in the certificate-generation script left private keys discoverable by testing 256 possible numbers.9to5Mac: “an error in a script used to generate these certificates led to a number of private keys that could be trivially discovered by testing just 256 possible numbers.”
Partly supportedDennis Jackson, a Mozilla cryptography engineer, warns that Macs remain vulnerable.9to5Mac: “Mozilla cryptography engineer Dennis Jackson warns that Macs may continue to trust them.”
Partly supportedJackson says macOS’s built-in trust store does not check revocation information.9to5Mac: “Jackson also warns that macOS’s built-in /usr/bin/curl utility may continue trusting the compromised certificates because its certificate bundle does not check revocation information.”
SupportedA Mac that has already accepted a compromised certificate will continue to trust it.9to5Mac: “In other words, if your Mac has already accepted one of the certificates, then it will continue to do so.”
SupportedThe macOS /usr/bin/curl utility may continue trusting the certificates for the same reason.9to5Mac: “Jackson also warns that macOS’s built-in /usr/bin/curl utility may continue trusting the compromised certificates because its certificate bundle does not check revocation information.”
SupportedThere is currently no evidence the certificates have been used in the wild.9to5Mac: “However, there is currently no evidence of them being used in the wild”
Partly supportedApple is expected to address the issue in an upcoming security update.9to5Mac: “it’s something that Apple is likely to be able to fix in an upcoming security update.”