Basic Attestation User Root CA Keychain Mac OS Bigsur (macbook pro nov 2020)

I have something maybe related.

I have just started seeing a check/circle beside each (I have 100's) email in my contacts.

Clicking on it shows;

"Basic Attestation User Sub CA1"

"Expires: Sunday, March 21, 2032 at 8:00:00 PM Eastern Daylight Time"

""Basic Attestation User Sub CA1" certificate is not trusted"

"Organization: Apple Inc."

I called Apple Support and they checked with Engineering.

Engineering thought may be a certificate I created for secure email or something like that.

But is not.

The case is still open with Apple.

I'm seeing the same thing on my machine. I first noticed the certificate in my Keychain while I was looking into a different issue. Since it wasn't trusted, I exported it (just in case), then deleted it. But the checks are still showing up in Contacts, and they still show the untrusted cert.

Hello,

Any useful feedback from other users or from Apple. I don't know where to start looking. This error started when I migrated to a MBPro M1.

Symptoms:

1. All my contacts' email addresses in Contacts appear to have a certificate installed but it is the certificate that is not trusted: CA1
2. My own s/MIME certificate is now invisible because all I can see is this "Basic Attestation ... not trusted"
3. Havent received any reports of errors or problems with my certificate though, I suppose it is only some visualisation error on my computer.
4. Cannot check the authenticity of any certificate in emails they are all replaced by "Basic Attestation ... not trusted"

I'm guessing this is not a priority to Apple since there is no major usability constraint.

Your comments would be appreciated.

Mac Book Pro M1 Big Sur 11.1

Update:

I could not find this certificate in either:

Keychain

/System/Library/Security/Certificates.bundle/Contents/Resources/TrustStore.html

Was on a second call with Apple support yesterday.

They asked me to create a new user account to test.

This issue with the certificate showing in Contacts does not occur with the new user account.

Only with the admin account.

Apple support sent me an Capture_Data.dmg app.

And I sent them a large file for Apple Engineering to look at.

Apple support will be calling me back late Thursday (Jan 27, 2021) to followup.

Will report what they say.

Just had a reply from Apple support.

Saying in essence:

They have heard reports of this behavior....currently investigating....no estimated time frame for resolution...will let me know when/if resolved.

...anyone know why my name has a TV icon instead of an OS? I don't have an Apple TV.

That is a Specialty.

You generally only need to post a discussion on that topic or in that area to get the first level.

If you click on your user name at the top, left of this page, then click on that Specialty, it should tell you what is required to earn it. There is also a link to more information about all the "perks" in the community. It only talks about Specialties in general, not specific to one.

I'm seeing the same thing on an M1 Mac mini running macOS 11.2.1. The certificate is nowhere in Keychain Access that I can see, but the checkmarks appear in Contacts. I've also noticed messages in the Messages app from contacts whose threads are using email are getting labeled as "Maybe: __" in notifications, which I feel may be related if whatever this is makes the OS think the emails are all authenticated via the cert, but the cert is not trusted. Weird issue. I'll trust those of you who've already posted have done what any of us can to alert Apple to the problem and just sit tight and wait for a resolution at some point.

I've submitted a bug report to Apple (FB9004740, if anyone wants to write their own and note others reporting the same bug) about this. While others have contacted "normal" Apple support, as someone who is a developer I realized I should submit an actual bug report using the tool they give us to report issues. Hopefully between all of us using various means to alert Apple to the problem, they'll eventually be able to fix it.

Does anyone have a solution for this yet? I have the same issue on a 13 inch M1 MacBook Pro.

After a LOT of reloads, I’ve found the issue is initiated on my machine by opening the App Store while connected to the internet. 

I wipe and reinstall per Apple’s instructions(Recovery Terminal double resetpassword method) to clear the issue. A wipe is the only way I’ve found to clear it. After that it doesn’t matter what iteration of 11.2 to 11.2.3, signed-in to iCloud/App Store or not , Admin or not - App Store while connected to the internet does it. If I am signed in, all email addresses in my iCloud Contacts have the badge. If not signed in I create a test Contact with fake email address and it ends up with the badge. No other Apps, and I’ve opened them all, cause the problem.

Keychain looks normal until I create the issue by opening App Store. That produces 3 similar Local Items in Keychain; com.apple.AppleMediaServices.anti fraud-.....

I had access to an M1 MacBook Air fresh out of the box(11.1), it exhibited the same behavior. I’ve used internet connections at other locations and the problem still shows up.

In the absence of another solution, has anyone tried a Restore with Apple Configurator 2 from another computer?

I was unable to email (send or receive) with a person in the Caribbean from my home in MD using my @me.com address and we couldn't figure out why as I email with many folks there. They had not blocked me, nor I them. That was with my Intel MacBook Pro. We worked around it using a different email address not connected to iCloud. Then when I got my new M1 MacBook Air I had the same issue but now that address was listed as having this Basic Attestation issue, expiring in 2032. Not sure if this helps solve the mystery but take it for what it is worth and let me know if it helps.

This is something Apple have to solve somehow, they have an invalid Apple certificate installed on their new MacBooks. People want to be able to use their iCloud email address with a valid certificate.

The certificate will only tell your correspondants that the message comes from you (if you have that type of certificate), but wont secure the communication itself.

All in all, this error of Basic Attestation seems to be affecting only visualisation of your own installed certificates, but doesn't really affect the use certificates in general.

Still, very disturbing, I agree with you.

This seems to be fixed with 11.3. Immediately after the update it didn’t look that way, but opening the App Store cleared the problem.

In my prior comments, after a full OS reload things seemed fine until I tickled the App Store. Now it seems that is necessary to clear it.

There are a lot more entries in my Keychain after this update, but the problem seems to be resolved.

Fingers crossed.

I have the same issue, MacBook Air M1, Big Sur 11.2.3, Sweden. Not sure how to correct this, none of my contacts have a 'golden badge' so I am wondering if communication is secure ?

Hi !

Since January 2021, I have the same behaviour on my M1 MacBook Air.