I pointed this out yesterday and people thought I was nuts:

https://news.ycombinator.com/item?id=50189521

I suspect Apple published no update and is relying on the CA's CRL and/or OCSP to do its job. But it's rate-limited, the connections time out, and iOS is hard-coded to soft-fail.

Like you my trust store is months old.

That said, I found separate installs of Firefox and Microsoft Edge that accepted *all* the bad certificates without a care.

The only browser that consistently rejected all of them was — you guessed it — Internet Explorer. A browser so old it couldn't even run the test properly but it did what it needed to and blocked all the servers.

To be honest, this whole experience has left me with a very sour taste in my mouth. It feels to me that the whole CA industry needs reform.

I am not smart enough to say how, but the sheer amount of work this created across the industry is monstrous. It probably has cost $billions to mitigate, and those mitigations have been slow and ineffective (see: my iPhone still being vulnerable).

In my experience, seemingly random pieces of software, libraries, and programming languages packaging their own CA stores has made this much harder to mitigate than simply running 'apt-get update ca-certificates'. We've practically just had to update every single thing to mitigate this.