Apple Blocks Eight Compromised Web Certificates, but macOS May Still Trust Them
Apple blocked eight compromised web certificates, but a Mozilla engineer warns that macOS may keep trusting them until a security update arrives.
The certificates are intermediate certificates, which are used to prove ownership of a website. When a user visits a site such as apple.com, Safari checks the certificate chain to confirm that the site is genuine.
According to 9to5Mac, an error in a script used to generate the certificates left a number of private keys that could be trivially discovered by testing just 256 possible numbers. The eight affected certificates have been revoked, and steps have been taken to ensure that the flaw will not affect any certificates issued in the future.
Bleeping Computer reported that Apple, Google and Mozilla have each blocked the compromised certificates in their respective browsers. Mozilla cryptography engineer Dennis Jackson warned, however, that Macs may continue to trust them. Jackson also warned that the macOS built-in /usr/bin/curl utility may keep trusting the certificates because its certificate bundle does not check revocation information. In effect, if a Mac has already accepted one of the certificates, it will continue to accept it.
There is currently no evidence that the certificates have been used in the wild, and the issue is likely to be fixable in an upcoming security update, 9to5Mac reported.