Previously today, I encountered a SSL error trying to access twitter.com in Chrome. Investigating the issue, I encountered the same error accessing discussions.apple.com. Most other HTTPS sites were working fine. Trying Safari, the same errors occurred but I was given the option to continue regardless.
At first I thought it was this Apple security update issue, especially since it was suggested that Cyberduck with Amazon S3 was causing it and I had accessed S3 with the affected version just a couple days ago. However, I recall previously having dealt with this issue, and looking at Keychain today I didn't see the duplicate certificates that were being reported by others.
After further investigation, twitter.com on my iMac is signed by the following certificate:
VeriSign Class 3 Public Primary Certification Authority - G5 Serial: 35 97 31 87 F3 87 3A 07 32 7E CE 58 0C 9B 7E DA SHA1: F4 A8 0A 0C D1 E6 CF 19 0B 8C BC 6F BC 99 17 11 D4 82 C9 D0 MD5: 32 A1 9C 63 E8 B6 02 89 3C 67 48 29 D0 40 AB C8
According to Symantec (and my Keychain), this is not the correct certificate. My Macbook and a coworkers iMac show twitter.com signed by the correct certificate:
VeriSign Class 3 Public Primary Certification Authority - G5 Serial: 18 DA D1 9E 26 7D E8 BB 4A 21 58 CD CC 6B 3B 4A SHA1: 4E B6 D5 78 49 9B 1C CF 5F 58 1E AD 56 BE 3D 9B 67 44 A5 E5 MD5: CB 17 E4 31 67 3E E2 09 FE 45 57 93 F3 0A FA 1C
Similar things are happening on other Verisign sites I've tested (apple.com and subdomains, verisign.com), except for Symantec.com, which is signed with a different CA cert, but still incorrect.
VeriSign Class 3 Public Primary Certification Authority - G5 Serial: 25 0C E8 E0 30 61 2E 9F 2B 89 F7 05 4D 7C F8 FD SHA1: 32 F3 08 82 62 2B 87 CF 88 56 C6 3D B8 73 DF 08 53 B4 DD 27 MD5: F9 1F FE E6 A3 6B 99 88 41 D4 67 DD E5 F8 97 7A
This is signed by the correct cert on every other computer I've tested on. No other CA seems to be effected. I switched from wired to wireless on my iMac but the issue persisted.
This seems like symptoms of a MITM attack, but it seems to be local to my iMac since no other computers on the network are exhibiting this, which seems a direct contradiction.
I'm thoroughly confused and very worried. I've airgapped my iMac and am running a virus scan on it now. What's going on? What steps can I take from here?