{"version":"2.1.40","anchor":"macos-sandbox-tls-certificate-verification","canonical_anchor":"macos-sandbox-tls-certificate-verification","heading":"macOS Sandbox: TLS Certificate Verification","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.40\/e\/macos-sandbox-tls-certificate-verification","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.40","markdown":"### macOS Sandbox: TLS Certificate Verification\n\n**What**\n\nNew setting to allow Go programs to verify TLS certificates via trustd agent.\n\n**Usage**\n\nConfigure in sandbox settings:\n\n`{ \"enableWeakerNetworkIsolation\": true }` **Details** - Required for Go programs (gh, gcloud, terraform, kubectl) using MITM proxies with custom CAs - Enables access to `com.apple.trustd.agent` mach service - Security trade-off: Opens potential data exfiltration vector through trustd **Evidence** Trustd agent setting (search for `\"Enable weaker network isolation\"`, `\"com.apple.trustd.agent\"`)"}