Apple blocks eight compromised certificates as engineer warns of Mac trust gap

Apple has blocked eight compromised web security certificates, but Mozilla cryptography engineer Dennis Jackson warns that Macs may continue trusting them, 9to5Mac reported. A script error left private keys discoverable by testing just 256 possible numbers, potentially allowing website impersonation. Apple, Google and Mozilla have blocked the certificates in their browsers, and the certificates have been revoked. Jackson says macOS's built-in curl utility may still trust them because its certificate bundle does not check revocation information. There is currently no evidence that the certificates have been used in the wild.