xscertd-helper

executablemacOS262.7 KBx86_64, arm64

Security framework utility — manages keychain access, certificates, and code signing operations

Performs cryptographic operations and security certificate management through the macOS Security framework and keychain. Handles code signing validation, certificate chain verification, and secure credential storage/retrieval. Communicates with 7 network endpoints for certificate revocation checking, timestamp validation, and potential security policy updates. Accesses 5 bundle identifiers and manages multiple file paths, likely for code signature verification and entitlement validation workflows.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 262.7 KB
UUID: 28D17D4A-2D8A-3BCD-AD58-18E149A51CDC
Analyzed: 2026-04-09T10:12:50Z
CDHash: 21d5b1c97e8902674f7b2926a7229fd2675365c0ec415c6e1b10433303f536f0

Capabilities

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

Frameworks9

libcrypto.46.dylib Foundation LDAP SCEP Security SecurityFoundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Interesting Strings

Bundle IDs(5)

%s found in com.apple.opendirectory group anchor apple and identifier = com.apple.xscertd cn=com.apple.opendirectory.group com.apple.xscertd-helper com.apple.xscertd.helper

File Paths(9)

/Library/Keychains/System.keychain /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP /System/Library/Frameworks/Security.framework/Versions/A/Security

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation SecurityFoundation

Endpoints(7)

Urlhttp://www.apple.com/appleca/root.crl0

Hostnamewww.apple.com

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

2

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

0

File Paths

9

Bundle IDs

5

IOKit Constants

0

Library Functions

2

Structural HashesSHA-256

Codeb1174db4a7a914b88ee4a16a2636348c94fa6b3085f6a311dec0c0128abde2ce

Imports8e40e2b91d891dbfaed1bc59207af1462d242a2cab6b7f26fe294f839ecec108

Frameworks7ef2dc845df5bc6cf2a2d16dd573ad23c88ef1f0aac06191edc0d9da113c7005

Classes56f68bd7ae7424fbea5951c032fb07f82c3c09cbcf8c44b4630d7af3e37a0656

Entitlementse3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Symbols6afdd05fd1d0c05e62d26946329c329d0bddb77bbe46c15ce48cb0a6d7f3340f

Static Libraries0 / 107 functions identified

Function Matches(2)

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

Functions(107)

0x100000d70sub_100000d70

0x1000015e8sub_1000015e8

0x100001668sub_100001668

0x1000017d8sub_1000017d8

0x1000019d8sub_1000019d8

0x100001d44sub_100001d44

0x1000020dcsub_1000020dc

0x100002218sub_100002218

0x100002630sub_100002630

0x10000275csub_10000275c

0x100002d60sub_100002d60

0x100002ee4sub_100002ee4

0x1000031bcsub_1000031bc

0x100003874sub_100003874

0x100003a14sub_100003a14

0x100003d7csub_100003d7c

0x100003e58sub_100003e58

0x100004274sub_100004274

0x100004804sub_100004804

0x100004860sub_100004860

Imports285 symbols from 9 dylibs

libSystem.B.dylib84 CoreFoundation58 Security51 libcrypto.46.dylib32 LDAP21

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

notification_proxy