> On Mac, some command-line tools included with macOS or the Xcode Command Line Tools (including curl, git, python3, ruby, perl, and openssl) check certificates against /etc/ssl/cert.pem. For certificates that chain to a root CA certificate in this file, these tools don't check Apple's block or whether the certificate has been revoked. This file will be updated in a future macOS update. If you use these tools and don't want to wait for the update, you can remove root CA certificates from the file.
Good on Apple for providing such a detailed article. Fuck everyone who thinks they're doing badly by not updating this file remotely on current software versions in the wild -- most likely their Rapid Security Response framework does not support this file (though perhaps it will). Being transparent and open about what administrators can do about this is the RIGHT APPROACH, and no other vendor has been nearly as thorough about this.
What a clusterfuck