Security, Certificates, and Keychain
This domain tests macOS security controls and credential storage: FileVault, Gatekeeper, System Integrity Protection, XProtect, keychains, certificates, and trust settings. Expect scenarios where an app is blocked, a certificate is not trusted, or a saved password is missing.
Security controls
FileVault encrypts the startup volume and requires a recovery key or institutional key escrow. Gatekeeper controls whether identified developers’ apps may launch; users can override per app in Privacy & Security, but managed Macs may prohibit it. System Integrity Protection protects critical system locations even from root. XProtect provides built-in malware signatures and is updated independently of major OS updates. These controls are separate: disabling one does not disable the others.
Keychain and certificates
The login keychain unlocks at login and stores user secrets; the System keychain stores system-wide secrets; iCloud Keychain syncs selected passwords. Certificates live in keychains and have trust settings that can be changed per certificate. A TLS failure can come from an expired certificate, a missing intermediate certificate, a hostname mismatch, or a trust setting of Never Trust. Use Keychain Access or security find-certificate and security verify-cert to inspect a chain. Code-signing identities and private keys must remain paired.
Worked example
A renewed web certificate is installed, but Safari still reports that the site’s certificate is invalid. Reasoning: the leaf certificate may be valid while the intermediate is missing, or the trust setting may be overridden. Inspect the full chain, confirm the hostname, and check the certificate’s trust settings. Do not “fix” it by globally trusting an unrelated root certificate.
Traps
- Deleting the login keychain destroys saved passwords and may create a new empty keychain.
- A valid certificate can still fail on hostname mismatch or missing intermediate.
- Gatekeeper and FileVault solve different problems; neither replaces the other.
- FileVault recovery key escrow must be verified before relying on it.