Apple is blocking the compromised certificates automatically.
But Mac administrators MUST TAKE ADDITIONAL steps for some command-line tools.
Some tools included with macOS or the Xcode Command Line Tools — like curl and git — check certificates against /etc/ssl/cert.pem and can still accept these certificates until a future software update.
To stop those tools from accepting them sooner, you can remove root CA certificates from the file.
https://support.apple.com/en-us/149555
But Mac administrators MUST TAKE ADDITIONAL steps for some command-line tools.
Some tools included with macOS or the Xcode Command Line Tools — like curl and git — check certificates against /etc/ssl/cert.pem and can still accept these certificates until a future software update.
To stop those tools from accepting them sooner, you can remove root CA certificates from the file.
https://support.apple.com/en-us/149555
