I have difficulty reaching various secure web sites. They give me a certificate expired error. They work on Firefox but not Safari or Chrome. They also work on newer versions of macOS (e.g. Catalina, Big Sur). This seems to be because Safari and Chrome use the OS root certificate store and Firefox uses its own, and El Capitan is not being updated.

From here there are:

  • Trusted certificates establish a chain of trust that verifies other certificates signed by the trusted roots — for example, to establish a secure connection to a web server. When IT administrators create Configuration Profiles, these trusted root certificates don't need to be included.
  • Always Ask certificates are untrusted but not blocked. When one of these certificates is used, you'll be prompted to choose whether or not to trust it.
  • Blocked certificates are believed to be compromised and will never be trusted.

There is a list of fingerprints of the current certificates there, but no downloadable bundles of certificates.

How do I update my root certificates on an older version of OS X 10.11


4 Answers 4


The easiest way to do this is to transfer your System Root certificates from another Mac to which you have access that runs a more modern version of macOS. (Why not just download them? See note that the end of this answer.)

  1. First find the more modern Mac with a working set of System Root certificates (i.e. that can access the problematic web sites)
  2. On that Mac, launch Keychain Access, select "System Roots", select all the certificates, select File->Export, and export them as rootcerts.pem file. This file will contain all the certificates concatenated.
  3. Copy the rootcerts.pem file to your antique mac
  4. Make the trustroot shell script below, e.g. by copying it into a file, then using chmod 755 trustroot
  5. Run sudo ./trustroot rootcerts.pem
mkdir -p ${DIR}
trap "rm -rf ${DIR}" EXIT
cat "$1" | (cd $DIR && /usr/bin/split -p '-----BEGIN CERTIFICATE-----' - cert- )
for c in ${DIR}/cert-* ; do
   security -v add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "$c"
rm -rf ${DIR}

What the script does is splits the .pem file into a number of certificates in the temporary directory concerned, then adds them as trustRoot certificates to the System key chain; they will then operate as trusted roots in addition to the certificates in the original "System Roots" keychain. In case you were wondering, you cannot add them to the System Roots keychain as that can only be updated by the operating system.

Note this copies over the first group of certificates ("Trusted Certificates" in the question), but not the second nor the third.

Kudos to this answer for a hint.

You might wonder why I didn't simply put a link to a more modern bundle of certificates somewhere on the web. After all, that would allow you to skip steps 1-3, and simply download rootcerts.pem. The answer is that you would have no way of knowing that I had not tampered with the root certificates and inserted one of my own, allowing me to impersonate any website by making a fake certificate signed with my own root certificate. Please therefore treat with extreme skepticism any advice to solve this problem by downloading root certificates from anywhere unless you can independently check the provenance of those certificates.

That said, if you have no other option, a reasonable place to download a certificate bundle would be from the curl web site here (untested), as most people trust curl.

  • 1
    Found out the issue, my dad forgot to enter the first line... (THANKS DAD) Anyway thanks for the help :D Commented Oct 1, 2021 at 19:14
  • 2
    This answer saved my bacon today. Worked like a charm. Commented Oct 1, 2021 at 23:39
  • 2
    You saved my mom's night. Thank you
    – Hammerbot
    Commented Oct 2, 2021 at 8:45
  • 1
    @stephana A typo maybe. Type chmod 755 followed by a space followed by t, then press TAB to have it auto-complete the name.
    – nohillside
    Commented Oct 18, 2021 at 12:16
  • 1
    this worked perfectly to update a system running MacOS 10.11.6 from a system running MacOS 10.15.7!!! Thanks!!
    – TimmyG
    Commented Oct 23, 2021 at 18:53

For anyone without access to an up-to-date Apple OS install: you can download the root certificate at cause (that one exclusively) from the issuer's site and install it. Instructions are here but double-check where in Keychain Access your system has stored the expired R3 certificate (could be "System Roots" instead of "System").

MacPorts have a port (apple-pki-bundle) which installs .pem file containing a bunch of certificates downloaded from Apple, GeoTrust and DigiCert (port source here. It does not at the moment include the ISRG certificate but I have to assume it contains at least a number of the certificates you'd get with the recipe outlined above. Checksumming ensures that you get the intended certificates; AFAICT you'll need to add the bundle to your system's root certificates yourself.

  • In order for this to be secure, you need to trust (some other way, i.e. not using their own root certificate) the website that you download the root certificate from. Also this will only update a single root certificate - the bundle has many tens of root certificates.
    – abligh
    Commented Oct 30, 2021 at 6:05
  • My answer does say that it's about the certificate which is causing probems at the moment. It is downloaded from the site of the organisation that issues it. I don't really see how you can do better - if a root certificate has to be signed by an independent entity it's no longer a root certificate AFAICT.
    – RJVB
    Commented Oct 31, 2021 at 9:39

Just tried these instructions on an old iMac Early 2009 with El Capitan (10.11.6)

Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.

For older macOS not updated by Apple:

  • Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/
  • Open the Keychain Access app and drag that file into the System folder of that app.
  • Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

everything becomes to work as expected.

  • this is exactly what i was looking for
    – dark_ruby
    Commented Jan 9 at 12:15

Given answers didn't help for console applications. I believe most of them are curl-based, and here is what you can do:

  • make a backup for /etc/ssl/cert.pem file
  • open /etc/ssl/cert.pem with your favorite editor (sudo vim /etc/ssl/cert.pem, for example)
  • search for DST Root CA X3. If you found this (already expired) root cert - this is the root of the problem
  • delete this cert. All 42 lines of cert starting ### Digital Signature Trust Co. to -----END CERTIFICATE-----
  • check if it's ok now with curl --cert-status https://example.com command (replace domain with real one, ofc)

Why it helps. For compatibility reasons LE certs have two ways to root cert. For some reason(compatibility?) validation path with "DST Root CA X3" cert is preferred one. And, as far as I understood, curl is preferring its own set of root certs (instead of System ones) which are located at /etc/ssl/cert.pem. So removing stale root cert forces curl to use "ISRG Root X1"(if it's already there, ofc). NB! So, if you're doing it on a really old system you might have to do one more step - add this root cert to this file. Just be careful and get it from a trusted source.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .