Apple revokes eight web certificates, but macOS may still trust them

Apple has revoked eight intermediate certificates that scammers could have used to impersonate legitimate sites: a script error made their private keys discoverable by testing just 256 numbers. Apple, Google and Mozilla blocked the certificates in their browsers, but Mozilla engineer Dennis Jackson warned that macOS and its curl utility do not check revocation and may keep trusting them.

• Private keys of eight certificates were brute-forceable with 256 tries
• Certificates are blocked in Safari, Chrome and Firefox
• macOS and /usr/bin/curl do not check certificate revocation
• No evidence of the certificates being used in the wild yet