Apple has revoked eight web certificates that were generated with a script flaw making their private keys dangerously easy to guess. Despite the revocation, Macs may still trust the compromised certificates because macOS lacks full certificate revocation checks under certain tools. The issue is now known, and Apple along with other browser makers has blocked them—but some users remain at risk until patching fixes arrive.
What Went Wrong: Weak Intermediate Certificates Exposed
Web identity is built on certificates that prove a site is really what it says it is. Intermediate certificates are a key link in that chain, vouching for a site’s validity. In this case, a scripting mistake led to these intermediate certificates using private keys that can be cracked with just 256 possible attempts. This severe weakness means a bad actor could potentially generate a matching certificate and impersonate a trusted site.
Eight such certificates have been identified and formally revoked. Apple, Google, and Mozilla have all acted within their browsers to block any use of these compromised certificates. The flaw has been addressed in certificate generation processes to prevent recurrence.
Why Some Macs Are Still At Risk
Even though the revoked certificates are blocked in browsers like Safari, Chrome, and Firefox, parts of macOS don’t check for revocation properly. A cryptography engineer warned that tools like /usr/bin/curl—a built-in utility used widely for command-line connections and scripting—rely on a certificate bundle that ignores revocation data. That means if a Mac has already accepted one of these weak certificates, it could continue doing so without warning.
No instances of these compromised certificates being exploited in real-world attacks have been found yet. Still, experts view it as a ticking time-bomb. Apple is expected to issue a security update that patches the parts of macOS that still blindly trust these revoked certificates.
Context: Certificate Security and Revocation Gaps
Public certificate authorities generate certificates that verify identity online. When one of these goes bad—due to weak keys or other issues—it must be revoked so clients (browsers, OS features, utilities) refuse connections relying on it. Modern browsers are very good at enforcing revocation. Operating systems and other tools are less consistent, especially for historical certificates or those stored locally.
This isn’t the first time weak certificates or revocation gaps have exposed users. Many security experts have flagged revocation checking in macOS—including for utilities and non-browser tools—as a persistent blind spot. Fixing certificate management completely often requires both updating components and changing policies so that every relevant part of the system checks the most current “certificate revocation lists” or uses OCSP (Online Certificate Status Protocol).
What this means:
- Browser users on Mac are mostly safe today; revoked certificates are blocked.
- Scripting tools, legacy services, or custom software using macOS’s built-in utilities may still trust the revoked certificates.
- Apple is likely to release a security patch to fix the revocation oversight, after which most risk should disappear.
- Users should keep macOS and all software up to date, and avoid trusting or installing unverified certificates.
Despite Apple’s swift revocation of eight intermediate certificates vulnerable to trivial key-cracking, the persistence of revoked-certificate trust in certain macOS tools highlights a meaningful security gap. The fix will require more than browser updates—it demands a patch to the operating system’s certificate trust chain. For Mac users, this is a reminder: security layers only work when every component plays by the rules. Keep an eye out for and install Apple’s upcoming update, because once this patch is out, much of today’s risk will vanish.
