This Frida script disables SSL pinning and verification on any target macOS Catalina process.

disable-ssl-pin.js

var SecTrustEvaluate_handle =
    Module.findExportByName('Security', 'SecTrustEvaluate');
var SecTrustEvaluateWithError_handle =
    Module.findExportByName('Security', 'SecTrustEvaluateWithError');
var SSL_CTX_set_custom_verify_handle =
    Module.findExportByName('libboringssl.dylib', 'SSL_CTX_set_custom_verify');
var SSL_get_psk_identity_handle =
    Module.findExportByName('libboringssl.dylib', 'SSL_get_psk_identity');
var boringssl_context_set_verify_mode_handle = Module.findExportByName(
    'libboringssl.dylib', 'boringssl_context_set_verify_mode');

if (SecTrustEvaluateWithError_handle) {
  var SecTrustEvaluateWithError = new NativeFunction(
      SecTrustEvaluateWithError_handle, 'int', ['pointer', 'pointer']);

  Interceptor.replace(
      SecTrustEvaluateWithError_handle,
      new NativeCallback(function(trust, error) {
        console.log('[*] Called SecTrustEvaluateWithError()');
        SecTrustEvaluateWithError(trust, NULL);
        Memory.writeU8(error, 0);
        return 1;
      }, 'int', ['pointer', 'pointer']));
  console.log('[+] SecTrustEvaluateWithError() hook installed.');
}

if (SecTrustEvaluate_handle) {
  var SecTrustEvaluate = new NativeFunction(
      SecTrustEvaluate_handle, 'int', ['pointer', 'pointer']);

  Interceptor.replace(
      SecTrustEvaluate_handle, new NativeCallback(function(trust, result) {
        console.log('[*] Called SecTrustEvaluate()');
        SecTrustEvaluate(trust, result);
        Memory.writeU8(result, 1);
        return 0;
      }, 'int', ['pointer', 'pointer']));
  console.log('[+] SecTrustEvaluate() hook installed.');
}

if (SSL_CTX_set_custom_verify_handle) {
  var SSL_CTX_set_custom_verify = new NativeFunction(
      SSL_CTX_set_custom_verify_handle, 'void', ['pointer', 'int', 'pointer']);

  var replaced_callback = new NativeCallback(function(ssl, out) {
    console.log('[*] Called custom SSL verifier')
    return 0;
  }, 'int', ['pointer', 'pointer']);

  Interceptor.replace(
      SSL_CTX_set_custom_verify_handle,
      new NativeCallback(function(ctx, mode, callback) {
        console.log('[*] Called SSL_CTX_set_custom_verify()');
        SSL_CTX_set_custom_verify(ctx, 0, replaced_callback);
      }, 'int', ['pointer', 'int', 'pointer']));
  console.log('[+] SSL_CTX_set_custom_verify() hook installed.')
}

if (SSL_get_psk_identity_handle) {
  Interceptor.replace(
      SSL_get_psk_identity_handle, new NativeCallback(function(ssl) {
        console.log('[*] Called SSL_get_psk_identity_handle()');
        return 'notarealPSKidentity';
      }, 'pointer', ['pointer']));
  console.log('[+] SSL_get_psk_identity() hook installed.')
}

if (boringssl_context_set_verify_mode_handle) {
  var boringssl_context_set_verify_mode = new NativeFunction(
      boringssl_context_set_verify_mode_handle, 'int', ['pointer', 'pointer']);

  Interceptor.replace(
      boringssl_context_set_verify_mode_handle,
      new NativeCallback(function(a, b) {
        console.log('[*] Called boringssl_context_set_verify_mode()');
        return 0;
      }, 'int', ['pointer', 'pointer']));
  console.log('[+] boringssl_context_set_verify_mode() hook installed.')
}

will it work on mojave?

I'm looking for a way to bypass certificate-pinning for Mac AppStore on 10.14. Is it possible?

good job.in my test,apple silicon 13.5 has a bug?
[] Called SSL_CTX_set_custom_verify()
Error: expected an integer
[] Called boringssl_context_set_verify_mode()
....

[] Called SecTrustEvaluateWithError()
[] Called SecTrustEvaluate()
Error: access violation accessing 0x0

As of Frida 17, they have changed the module api. https://frida.re/news/2025/05/17/frida-17-0-0-released/
Instead of Module.findExportByName('Security', 'SecTrustEvaluate'); it is now Process.getModuleByName('Security').getExportByName('SecTrustEvaluate')

So the first lines in the code should be

var SecurityModule = Process.getModuleByName('Security');
var libboringsslModule = Process.getModuleByName('libboringssl.dylib');

var SecTrustEvaluate_handle =
    SecurityModule.getExportByName('SecTrustEvaluate');
var SecTrustEvaluateWithError_handle =
    SecurityModule.getExportByName('SecTrustEvaluateWithError');
var SSL_CTX_set_custom_verify_handle =
    libboringsslModule.getExportByName('SSL_CTX_set_custom_verify');
var SSL_get_psk_identity_handle =
    libboringsslModule.getExportByName('SSL_get_psk_identity');
var boringssl_context_set_verify_mode_handle = 
    libboringsslModule.getExportByName('boringssl_context_set_verify_mode');

Thank you @azenla for amazing code.
And thank you @Philip2809 for the fix.
Both of you saved my life.

Thank you @azenla and @Philip2809 - this combo was the only thing that worked for some system processes that I've been trying to hook to for the past hour.

Oh my God, is macOS 26 not working anymore?

Failed to attach: unable to read from process memory