I need help with a strange looking certificate which has appeared in the Keychain of my Mac.

The name of the certificate is "A9936B80-41C7-4D34-8020-59C3E40A31A8 A98369B2-0C8C-4CF8-9921-015C5D9A4C86". It is installed in the login keychain under My Certificates. There is no clear name of an issuer, nor to whom it was issued.

It is not trusted by the system and after deleting it gets reinstalled again and again.

What it is?

  • Welcome to Ask Different :) Do you develop iOS apps, and debug them on a device? Are you a registered Apple Developer, without a paid membership of the Apple Developer program? – Nimesh Neema Jul 6 '19 at 8:18

I found a plausible explanation, the certificate is most probably related to studentd, see https://eclecticlight.co/2019/04/01/back-to-school-studentd-and-classroom-in-mojave-10-14-4/:

Although run from a system LaunchAgent property list, studentd is run as the user from login. If you log into a user account which doesn’t yet have one, it creates a security certificate in that user’s login keychain, with a name starting with ‘member:’ followed by two UUIDs. The first of these is that user’s UserIdentifier given in ~/Library/studentd/AdHocConfiguration.plist, thus is that student’s identifier for the purposes of studentd. That certificate isn’t trusted, but trust is obtained later if the user connects that Mac to a Classroom system.

  • Answers on AskDifferent should be more than just a link to prevent answers from becoming useless in case the link breaks. It's ok to include links for reference, but please add the essential parts of the link target directly into your answer. – nohillside Jul 8 '19 at 8:57
  • "Answers on AskDifferent should be more than just a link" My answer was more than just a link but for unknown reasons "nohillside" edited my reply. I bet you'll delete this! – user331752 Jul 8 '19 at 9:21
  • I've removed the follow-up questions included in your answer, they didn't add value to the answer itself. The essential part is still hidden somewhere on the linked page though, please edit this directly into your post. – nohillside Jul 8 '19 at 11:33
  • 1
    Welcome to Ask Different, Valdo - have a look at help center - especially the part about editing. Also, don't confuse kindness with niceness with constructive criticism. This site has long established norms on question quality, answer quality and collaboration. – bmike Jul 16 '19 at 11:46

I'm almost sure with UTMOST certainty that your MAC is hacked. I've been hacked for over 4 years now by "white hat" hackers AKA ethical hackers. These guys are actually curious about how you got tons of money and they make sure that you're doing it not in an illegal manner.

You must log in to answer this question.