4

Let me preface this with the fact that I know nothing about networking / security / etc. Twice now, I've had issues with root certificates not working and throwing errors, even though they are still valid.

Here's the link to my last post that was was fixed after an update to the OS (at this point, I cannot update any further, as my system is frozen based on older software that requires it).

Safari can't verify the identity of the website errors

Now, the same issue happened again and I can't figure out what to do. I've been worried that this is a MiTM attack, but didn't know what to do to fix it at this point. I deleted the key in question that had a red x next to it in Keychain and tried to reinstall the keys through Pacifist, but its still not working (also, I dont see the Key now after using the Pacifist method, so I'm not sure how to get it back, but the websites are still throwing errors.

enter image description here

If anyone has any suggestions to fix the issue (as I would like to safely get into some websites that requires this), or a solution to the overall problem, I would be EXTREMELY happy (I will be offering reputation points as soon as the option is open or will send directly, if its possible to do, if someone helps me to fix this sooner than that).

I'm on OS 10.8.5 currently.

EDIT:
I installed it and it now says, under "InCommon RSA Standard Assurance Client CA" - This certificate was signed by an unknown authority." I also have 3 to 4 other login certificates that are showing errors, each one of them has some sort of message about the "InCommon RSA Standard Assurance Client CA." Strangely, theres another certificate that is showing no errors that is signed by the InCommon RSA Standard Assurance CLient CA, but with a different expiration date. I'm lost. I can post photos of all the errors if necessary.

UPDATE: Upgraded from 10.8.5 to 10.10.5. Certificate issues still persist.

  • In an almost vanilla 10.8.5 I get a green light here! You are missing a "AddTrust External CA Root" (issued May 30, 2000) as root certificate in the whole cert chain. – klanomath Jan 25 '17 at 11:16
  • I deleted it because it was flagged as expired, even though the date of expiration hadn't been exceeded. – joe_04_04 Jan 25 '17 at 11:18
  • You can download it here (direct d/l link). It shows the same values (including sha/md5 of course) as in my ML system and you can add it to your System-Roots keychain. – klanomath Jan 25 '17 at 11:25
  • @klanomath, thank you for your help, but I tried to import it and the message in Keychain said "An error has occurred, not able to import an item: The contents of this item cannot be retrieved." The file you had for download was named, "AddTrustExternalCARoot.crl" Is this correct? – joe_04_04 Jan 25 '17 at 11:39
  • I'd recommend finding out if you actually are experiencing a man in the middle attack before addressing that as the problem you are facing. See security.stackexchange.com/questions/93869/… – Mr. Kennedy Feb 1 '17 at 19:37
2

My first best option would be to back up your files, wipe the machine entirely and reinstall the operating system from known good media. Especially since you say this issue has been going on for a while and you are unable to recall all the changes you've made. This is the fastest, safest option.

If that isn't an option, then you need to download and replace all the root certificates that were deleted. Find a machine that you trust and use it to download the root or intermediate certificates from trustworthy sites. Each time you get a message saying "...signed by an untrusted issuer" you need to locate the certificate that was used to sign it, download it and install it. That is the only way to get rid of these errors. Sorry but there is no quick fix that is going to undo this damage.

Lastly, I would seriously, strongly recommend updating to the most recent version of macOS that will install on your Mac. You seem to be concerned about security. Running an operating system that Apple stopped patching (i.e. abandoned) in August 2015 isn't a good idea. If you are stuck using 10.8.5 because pieces of software haven't been updated it is time to drop them or even post question(s) here looking for help either getting them working on newer versions of macOS or finding replacements.

  • I would love to be able to upgrade my Mac, but it's not a few pieces of software, it's hundreds. I use it for studio production and I run an older version of pro tools with older audio plugins. The total money alone from upgrading my plugins and PT rig would be in the thousands. It really sucks to be frozen on this OS. I have a MacBook Air that is totally clean running the newest version of Sierra, should I attempt to get those certificates? Is there a good procedure for this? – joe_04_04 Feb 1 '17 at 22:05
  • It might be willing to upgrade to the last version OS supported by Pro Tools 11 (10.10.5) – joe_04_04 Feb 1 '17 at 22:42
  • Updated from 10.8.5 to 10.10.5. Certificates are still screwed up. – joe_04_04 Feb 3 '17 at 5:31
  • @joe_04_04 Glad to hear you took the leap to an OS that is still receiving security updates, but sorry if I wasn't clear. I meant that you should wipe the machine and install a newer version of the operating system, not just upgrade in place. – Alistair McMillan Feb 3 '17 at 10:37
  • Would doing a "recovery mode" install suffice? I assume the combo upgrade from 10.8.5 to 10.10.5 didn't install anything related to keychains, since nothing was changed, but a recovery mode install should entirely replaced the whole OS, and not just add to part of it like a combo update does. I know this STILL isn't as good as wiping the machine and doing a clean install, then installing every single item back to the way it was, but I have literally so much installed for my home studio that it would take weeks, if not months on my lower-speed connection to fix it up the same way (or close). – joe_04_04 Feb 3 '17 at 10:41
1
+25

Download and install the AddTrust External CA Root which is linked from Comodo.

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • I installed it and it now says, under "InCommon RSA Standard Assurance Client CA" - This certificate was signed by an unknown authority." I also have 3 to 4 other login certificates that are showing errors, each one of them has some sort of message about the "InCommon RSA Standard Assurance Client CA" – joe_04_04 Jan 28 '17 at 20:48
1

One should never delete a Root Certificate.

And you should never delete a Root Certificate that has been Marked as Invalid before its expiration Date has been reached.

There was a reason why it was marked as invalid.

Mostly because the Issuer of the Certificate mark it as invalid (this could have been done because he got hacked or whatever could have compromised his Root Certificate).

Now you/your Browser don't have the Root Certificate so you/your Browser aren't able to validate any Certificate which is trusted by this Root.

So it depends on the Browser and how it handles Certificates of a Root it doesn't know.

If the Browser acts correct he will show you each Certificate based on this Root as invalid but some Browsers (at least in Past) didn't handle this correct and would have shown Certificates without a Root they know as valid.

  • 4
    -1 because what you wrote comes across as overly condescending to me. It is also not an answer to the question, which explicitly asked for suggestions to fix the issue. – Synoli Jan 28 '17 at 9:21
  • To be fair, this is excellent counsel. Condescension? I don't see it. OP deleted a invalid/revoked Root Cert. I've made this mistake. I'd forgotten about it until reading this. The best solution to a problem is not having it. +1. – chiggsy yesterday
1

I understand you want to fix your Apple certificates and I´m sorry you are having problems. First off you need to understand what certificates were intended for originally and what they have become in the new modern economy of corporate driven 3d proxy internet. A certificate is a text file that usually has 1024 2048 etc. Characters. In other words, root and user certificates are just two separate text files that maintain a mathematical relationship.

Go ahead and compare the certificate installation process for Google Android Studio and Xcode iTunes Submit. With Xcode you need a whole inter-department banana farm of certificate garbage at Apple to get up-and-running. Google is a download and click.

Now I hate to tell you this but you need to break the certificate engine inside OSX with a linux patch because the only way the root certificate at apple will build pyramid math to approve your certificate is if your mac is under warranty.

Also keep in mind if you are within the United Kingdom it is illegal to participate in a planned obsolescence plan such as Apples illegal misuse of data certs as blacklisting technology.

Good luck!

0

Download Firefox, it has its own CA Root certificates store.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .