How to update my root certificates on an older version of macOS (e.g. El Capitan)?

Question

I have not been able to get the script from this post to work. How do I update my root certificates on an older version of macOS (e.g. El Capitan)? How do I update my root certificates on an older version of Mac OS (e.g. El Capitan)?

I have an old mac laptop running El Capitan 10.11.6 that I can't update the system on due to work apps. With the recent updated certificate problem, many internet sites are throwing errors for legitimate sites rendering the laptop fairly useless.

The post above has a script in it to update certificates that others have used successfully.

From the prior post answer:

1. First find the more modern Mac with a working set of System Root certificates (i.e. that can access the problematic web sites)
2. On that Mac, launch Keychain Access, select "System Roots", select all the certificates, select File > Export, and export them as rootcerts.pem file. This file will contain all the certificates concatenated.
3. Copy the rootcerts.pem file to your antique Mac.
4. Make the trustroot shell script below, e.g. by copying it into a file, then use: chmod 755 trustroot
5. Run sudo ./trustroot rootcerts.pem

#!/bin/bash
DIR=${TMPDIR}/trustroot.$$
mkdir -p ${DIR}
trap "rm -rf ${DIR}" EXIT
cat "$1" | (cd $DIR && split -p '-----BEGIN CERTIFICATE-----' - cert- )
for c in ${DIR}/cert-* ; do
   security -v add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "$c"
done
rm -rf ${DIR}

Anyway, I bogged down when it came to using Terminal. Can someone please give me some total idiot, step by step directions? I was able to make and transfer the rootcerts.pem file from a newer computer, but then it all fell apart.

Questions:

Where is the rootcerts.pem file supposed to be filed on the old machine?

I opened Terminal and it shows my hard drive, and then what? The directions say to make the script by copying it into a file. I presume copying it into a file means copying the #!/bin/bash section above into the Terminal shell?

Then you use: chmod 755 trustroot

Does that mean you copy chmod... into Terminal after adding the #!/bin/bash section?

Next run sudo ./trustroot rootcerts.pem

I assumed that meant that you copy this into Terminal after chmod?

Results:

After -----BEGIN CERTIFICATE-----' - cert- ), I get

cat: : No such file or directory 

Then:

***Error reading file /var/folders/db/y44522y562b31ctgp11mz8000000gn/T//trustroot.1429/cert-*

I don't know what this means, which file has the problem, or how to correct the problem. Any ideas?

I tried looking up directions for using Terminal, but those directions don't seem to follow the steps here and I'm not sure what I'm missing and what corrections to make. I can do many things, but when it comes to Terminal, my brain shuts down.

Answer 1

Important! To save yourself grief and extra work:

1. Back up all Keychain files before running this script. Here: HD/Library/Keychains Here: HD/System/Library/Keychains Here: HD/Users/YourHD/Library/Keychains

2. Only export root certificates from a new Mac that are not already listed in your old System Roots certificates.

3. Do not Delete any System Roots certificates in Keychain Access.

After spending more time on this than I ever wanted to, I got the script in https://apple.stackexchange.com/a/422333/9058 working. I don't know if it's the right way to do it, but it is working and I can now access all the sites that were being blocked as invalid on Safari and Google Chrome that are actually valid.

For anyone else who wants to try doing this, this is what I did to get the script working. This worked on an old Mac laptop running El Capitan 10.11.6.

I made a folder titled certificates on my user hard drive. I put the rootcerts.pem file from the new Mac in the folder.

I then opened a text editor to make a file for the script. (TextEdit or TextWrangler etc. If using TextEdit format the file as plain text.)

Copy and paste the entire #!/bin/bash script into the new file. Save the file as trustroot.sh in the certificates folder.

Open terminal. I didn't know what directory I was in so I entered: echo $PATH

I was in the wrong directory so I entered the path to get to where I had created the folder (Your PATH/path may be different depending on where you saved your folder):

At the next prompt enter: cd ~/certificates/ Hit return.

Next enter: chmod 755 trustroot.sh Hit return.

Last enter: sudo ~/certificates/trustroot.sh rootcerts.pem Hit return and the script will run.

Or:

cd ~/certificates/
chmod 755 trustroot.sh
sudo ~/certificates/trustroot.sh rootcerts.pem

To log out of Terminal after script ends type: exit

The script ran perfectly and added the new certificates to the System folder in Keychain Access.

Return to Keychain Access and set only the SSL value of the new certificates to "Always Trust." The remaining menus should be set to "Use Custom Settings" and the rest set to "no value specified."

I don't know much about certificate security so if someone has a better answer, please correct this answer.

Important Note: If you imported Duplicate root certificates to your System Keychain, you will overwrite the Root certificate trust settings in the System Roots Keychain. The System Roots certificate will now be set to use "Always Trust" which is a security problem. Duplicates will have blue crosses on the certificates indicating the certificates are using Custom Settings.

How to change the System Root certificates from using Custom Settings back to using the System Default settings:

1. In Keychain Access, delete any duplicate certificates from the System Keychain. Do not delete any System Roots Keychain certificates.

2. In the System Roots Keychain, open a certificate with a blue cross indicating a certificate with Custom Settings. Open the Trust section. Change all sub-menus from "Always Trust" to "no value specified." The main menu value should change to "Use System Defaults." Close the certificate window.

Enter your admin password when asked if you want to modify the keychain.

3. Reopen the certificate you just changed. Select "Use System Defaults" again. Close the certificate.

Enter your admin password when asked if you want to update the keychain.

If you are not asked to enter your password after you close the certificate, the settings are not changed. Go back and reselect "Use System Defaults" again. Close and enter your password.

The blue cross takes a couple of seconds to disappear, but the Root certificate should return to the original system default settings.

Updating the trust settings creates a duplicate certificate in the System Keychain.

4. Open the System Keychain and delete the duplicate root certificates. Restart your machine.

You should now be able to use the internet again on your old Mac laptop.

Answer 2

The following procedure worked for me on a machine running El Capitan. Note that you need access to the GUI.

• Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/
• Open the Keychain Access app and drag that file into the System folder of that app.
• Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

Source: Certify The Web