xscertadmin

executablemacOS259.4 KBx86_64, arm64

Certificate and code signing validator — verifies digital signatures and certificate validity

Validates code signatures, certificates, and cryptographic identities using the Security framework and Keychain. Accesses network configuration to check certificate revocation and validate against trusted roots. Exposes an XPC service for other system components to query signature validity and certificate status. Manages multiple bundle identifiers and communicates with 7 network endpoints, likely for certificate authority lookups and revocation checking.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 259.4 KB
UUID: 5BE9274D-11CA-3A00-A533-1B7ABE1515D7
Analyzed: 2026-04-07T05:21:16Z
CDHash: 6094842a19118702a90738cbbd39e13c1ca25a7b3e196600c6debe0ad7608e43

Capabilities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

Frameworks11

libcrypto.46.dylib LDAP Security SCEP CoreFoundation OpenDirectory SystemConfiguration SecurityFoundation Foundation libobjc.A.dylib libSystem.B.dylib

Interesting Strings

Bundle IDs(5)

%s found in com.apple.opendirectory group cn=com.apple.opendirectory.group com.apple.certificate_authority_chain com.apple.opendirectory.cert.renewed com.apple.xscertadmin

File Paths(9)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory /System/Library/Frameworks/Security.framework/Versions/A/Security

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation SecurityFoundation

Endpoints(7)

Urlhttp://www.apple.com/appleca/root.crl0

Hostnamewww.apple.com

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

2

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

0

File Paths

9

Bundle IDs

5

IOKit Constants

0

Library Functions

3

Structural HashesSHA-256

Codeb42c85e71e65decae3af1bc3f444f657390f703bfe97a1f03b9eec3b73546a70

Imports631d3dc63edf06ec66aadd5d4432e2107041e3d52adf9324e2d0f611ebda45cd

Frameworks4d4ee9c44f98469a9eb80457fdb45731b2259626bf03d122f08ea9fd7abbe037

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementse3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Symbols631d3dc63edf06ec66aadd5d4432e2107041e3d52adf9324e2d0f611ebda45cd

Static Libraries0 / 87 functions identified

Function Matches(3)

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

Functions(87)

0x100000c20sub_100000c20

0x100000e20sub_100000e20

0x10000118csub_10000118c

0x100001524sub_100001524

0x100001660sub_100001660

0x100001a78sub_100001a78

0x100001ba4sub_100001ba4

0x1000021a8sub_1000021a8

0x10000232csub_10000232c

0x100002604sub_100002604

0x100002c94sub_100002c94

0x100002e34sub_100002e34

0x10000319csub_10000319c

0x100003278sub_100003278

0x100003694sub_100003694

0x100003c24sub_100003c24

0x100003c80sub_100003c80

0x100003e70sub_100003e70

0x100003ea4sub_100003ea4

0x10000413csub_10000413c

Imports252 symbols from 9 dylibs

CoreFoundation64 libSystem.B.dylib56 libcrypto.46.dylib48 Security24 LDAP21

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable