To be clear Apple&#x27;s OpenSSL (currently 0.9.8zg) supports SHA2 despite its deprecated status. You can&#x27;t link against it in El Capitan any more since they stopped shipping the development headers, but getting an OpenSSL that doesn&#x27;t support SHA2 is actually somewhat challenging (You&#x27;d either need an OpenSSL compiled with OPENSSL_NO_SHA or OPENSSL_NO_SHA256 or one that predates 0.9.7h).<p>None of that excuses Apple not checking this of course. Security.framework can do all this validation -- did they not historically provide code samples on how to do this without linking an external library?