3 ms·
When the story first broke, I manually untrusted WoSign's and StartCom's root certificates in OS X, instead of deleting them outright...at least I thought I did
by RJIb8RBYxzAMX9u 10y ago
When the story first broke, I manually untrusted WoSign's and StartCom's root certificates in OS X, instead of deleting them outright...at least I thought I did. I upgraded to macOS 10.12 Sierra this past weekend, and repeated the process. Except WoSign's certificates aren't there to begin with, though StartCom's still are. So perhaps Apple had dropped WoSign already? Would anyone else running 10.12 verify?
- pfg 10y agoIIRC WoSign was never in Apple's trust store in the first place; their trust status came from StartCom cross-signing their certificates. (Not sure if cached intermediate certificates get added to the keychain - maybe that's what you saw previously?)
- alpb 10y agoI can say +1. WoSign has never been in OS X trust chain as I hit this issue once before and had to install it myself manually. You can search about WoSign and OS X on Google and you will see that it was never there. If you found it in your trust store in the first place, there must be some shady business going on in your Mac. Also similar comments in this other HN thread: https://news.ycombinator.com/item?id=12389573 https://news.ycombinator.com/item?id=12389573
- an_account_name 10y agoI had distrusted a bunch of others, too - it looks like the update flipped everything to be trusted again. Thanks for the heads up.
- tveita 10y agoPossibly it is an intermediate certificate that is not cached yet. Does https://www.wosign.com/ https://www.wosign.com/ give you a certificate error, and does the certificate appear in the list after visiting the site?