App signatures are about more than just the certificate. That provides a chain of trust going back to Apple, and supports integrity checks and entitlements.
certificates
There have been changes to the way that macOS 12 checks executable code when asked to run it. Summarised in a diagram.
App signatures remain valid forever, but Installer packages are different, and their certificates can and do expire. What about notarization though?
Is Apple going to meet the promises it made a year ago, to protect its users around the world from the risk posed by its online signing certificate checks?
Now checks which versions of TLS a server supports, and gives details of its full headers with caching disabled.
A convenient utility to check secure connections under ATS using the nscurl command tool. For El Capitan to Monterey.
A detailed walk through the log shows Safari 15 checking Safe Browsing, phishing sites using ML, and performing trust evaluation of certificates.
It should have been so easy: a quick change of Root certificate. So why all the chaos, and most of all why you mustn’t compromise your security as a result.
Why do we keep having problems with security certificates when they’re just supposed to work? A look at what they do, and they work.
Did you think it was only old Mac OS X affected by the Let’s Encrypt certificate expiry problem? No, it’s Safari wherever you can use it. Here’s how to deal with it.
The Eclectic Light Company 