3

Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be vulnerable to MITM? Snapshot of my keychain after manually diabling two notorious CA

Improve this question

1 Answer 1

Reset to default
3

Apple's reaction to the StartCom irregularities is:

Apple products will block certificates from (...) StartCom root CAs if the 'Not Before' date is on or after 1 Dec 2016 00:00:00 GMT/UTC. (Source)

So to verify certificates that have a 'Not Before' date prior to the one mentioned above, they need the StartCom certificate.

With regard to Symantec certificate authorities they've decided on the following timeline:

Starting August 1, 2018: Partial distrust of Symantec CAs

(...)

Later date: Full distrust of Symantec CAs

(Source)

I guess the 'later date' hasn't arrived yet which is why they still need the Symantec certificates.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .