In pracitce, those root CAs have already been removed in major browsers. If your server uses them, you would likely have needed to migrate to another root already.
replydeleted
replyPKI works on trust. When a CA does things that violate that trust, their root gets removed. That's how it's supposed to work.
replyApple’s own security framework is supported by curl with OpenSSL or GnuTLS (build with ./configure --with-apple-sectrust). That blocks the intermediate certificates via the same mechanism Safari uses for example.
replyNot sure why macOS doesn’t ship such a build of curl.
It's relatively new I think.
replyI'm no expert in the matter, but weren't only the intermediate CAs compromised, not the root?
replyYep, but the certs.pem file only contains the root and does not know anything about intermediates.
replySo the only way to fix apps that don’t handle revocation of intermediates (eg the ones that only look at certs.pem) is to revoke the root.
I think it’s possible to add intermediate certificates with distrust marker attributes to bundles with OpenSSL. But other libraries consuming the bundle would not understand it, so the problem remains.
reply> Removing the root CA will mean that these valid certificates no longer work.
replyGreat, that’s fine. They can reissue.