5

After the DigiNotar certificate debacle, I tried to remove their certificate from my Keychain. However, I think I deleted the wrong one. I am not sure which one it was, but trying to go to https://github.com in Chrome shows me a Error 202 (net::ERR_CERT_AUTHORITY_INVALID).

Whoops. How can I restore the default certificates into my keychain?

|improve this question
5

You want the two files ending in *.keychain found in /System/Library/Keychains (note that they may differ depending on your region, I'm not sure if things change depending on your geo-location).

Unfortunately, there is no way to roll back unless you have a Time Machine backup, or the install files from the OS (then you can extract them using something like Pacifist).

Alternatively, you can run Keychain First Aid from the Keychain Access menu and hope it fixes things but those likely will only deal with errors or anomalies in your user's keychain, not the system's.

ATTENTION: For those in a similar position, these are all the files located under /System/Library/Keychains from a default installation of Snow Leopard 10.6.8 (in North America).

|improve this answer
  • The problem with CA stuff is that it pays to be paranoid. I would be veeeery wary of trusting someone from the internet to send me a bunch of CAs. But the OS install files and Keychain Repair stuff sounds promising. I'll try that to see if it helps, and accept if it does. – jergason Sep 6 '11 at 5:09
  • Jergason, I got my hands on a system running Snow Leopard 10.6.8 and have uploaded the entire contents of /System/Library/Keychains. You can trust that I'm not some wag or unscrupulous individual out to get you by injecting malicious signatures and grab it here: cl.ly/9uyP – user10355 Sep 6 '11 at 16:01
  • You are either a very nice person or an evil hacker attempting to destroy my life. :) Thanks, I will check this out. Maybe I can just diff it somehow and see what I am missing. – jergason Sep 6 '11 at 17:20
  • Heh. I'd like to think the former, but I've had my fair share of moments that I'm not too proud of ;) I had to restore my own system keychain after the DigiNotar threat so I empathize. I ended up deleting them when I should have marked them as "Not Trust." Anyway, they are there for you and all those on SL that might need it :) – user10355 Sep 6 '11 at 19:24
2

The fastest way back is to restore /System/Library/Keychains from your backup. Do make a backup now in case your system doesn't work properly after a reboot.

The next best is to install a clean copy of Snow Leopard onto an external drive. If your installer is older than the latest (or your preferred) patch level, do run updates ( or download and run the combo updater for your preferred ) to ensure you get any changes made to these files. Copy the same keychain files over once you've patched your rescue OS.

Failing these, you might have (or want) to reinstall the entire OS. Things in /System or /Library can easily break the normal functioning of your mac if modified.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .