How do I update my root certificates on an older version of Mac OS (e.g. El Capitan)?

Question

I have difficulty reaching various secure web sites. They give me a certificate expired error. They work on Firefox but not Safari or Chrome. They also work on newer versions of macOS (e.g. Catalina, Big Sur). This seems to be because Safari and Chrome use the OS root certificate store and Firefox uses its own, and El Capitan is not being updated.

From here there are:

• Trusted certificates establish a chain of trust that verifies other certificates signed by the trusted roots — for example, to establish a secure connection to a web server. When IT administrators create Configuration Profiles, these trusted root certificates don't need to be included.
• Always Ask certificates are untrusted but not blocked. When one of these certificates is used, you'll be prompted to choose whether or not to trust it.
• Blocked certificates are believed to be compromised and will never be trusted.

There is a list of fingerprints of the current certificates there, but no downloadable bundles of certificates.

How do I update my root certificates on an older version of OS X 10.11

Answer 1

The easiest way to do this is to transfer your System Root certificates from another Mac to which you have access that runs a more modern version of macOS. (Why not just download them? See note that the end of this answer.)

1. First find the more modern Mac with a working set of System Root certificates (i.e. that can access the problematic web sites)
2. On that Mac, launch Keychain Access, select "System Roots", select all the certificates, select File->Export, and export them as rootcerts.pem file. This file will contain all the certificates concatenated.
3. Copy the rootcerts.pem file to your antique mac
4. Make the trustroot shell script below, e.g. by copying it into a file, then using chmod 755 trustroot
5. Run sudo ./trustroot rootcerts.pem

#!/bin/bash
DIR=${TMPDIR}/trustroot.$$
mkdir -p ${DIR}
trap "rm -rf ${DIR}" EXIT
cat "$1" | (cd $DIR && /usr/bin/split -p '-----BEGIN CERTIFICATE-----' - cert- )
for c in ${DIR}/cert-* ; do
   security -v add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "$c"
done
rm -rf ${DIR}

What the script does is splits the .pem file into a number of certificates in the temporary directory concerned, then adds them as trustRoot certificates to the System key chain; they will then operate as trusted roots in addition to the certificates in the original "System Roots" keychain. In case you were wondering, you cannot add them to the System Roots keychain as that can only be updated by the operating system.

Note this copies over the first group of certificates ("Trusted Certificates" in the question), but not the second nor the third.

Kudos to this answer for a hint.

---

You might wonder why I didn't simply put a link to a more modern bundle of certificates somewhere on the web. After all, that would allow you to skip steps 1-3, and simply download rootcerts.pem. The answer is that you would have no way of knowing that I had not tampered with the root certificates and inserted one of my own, allowing me to impersonate any website by making a fake certificate signed with my own root certificate. Please therefore treat with extreme skepticism any advice to solve this problem by downloading root certificates from anywhere unless you can independently check the provenance of those certificates.

That said, if you have no other option, a reasonable place to download a certificate bundle would be from the curl web site here (untested), as most people trust curl.

Answer 2

For anyone without access to an up-to-date Apple OS install: you can download the root certificate at cause (that one exclusively) from the issuer's site and install it. Instructions are here but double-check where in Keychain Access your system has stored the expired R3 certificate (could be "System Roots" instead of "System").

MacPorts have a port (apple-pki-bundle) which installs .pem file containing a bunch of certificates downloaded from Apple, GeoTrust and DigiCert (port source here. It does not at the moment include the ISRG certificate but I have to assume it contains at least a number of the certificates you'd get with the recipe outlined above. Checksumming ensures that you get the intended certificates; AFAICT you'll need to add the bundle to your system's root certificates yourself.

Answer 3

Just tried these instructions on an old iMac Early 2009 with El Capitan (10.11.6)

Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.

For older macOS not updated by Apple:

• Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/
• Open the Keychain Access app and drag that file into the System folder of that app.
• Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

everything becomes to work as expected.

Answer 4

Given answers didn't help for console applications. I believe most of them are curl-based, and here is what you can do:

• make a backup for /etc/ssl/cert.pem file
• open /etc/ssl/cert.pem with your favorite editor (sudo vim /etc/ssl/cert.pem, for example)
• search for DST Root CA X3. If you found this (already expired) root cert - this is the root of the problem
• delete this cert. All 42 lines of cert starting ### Digital Signature Trust Co. to -----END CERTIFICATE-----
• check if it's ok now with curl --cert-status https://example.com command (replace domain with real one, ofc)

Why it helps. For compatibility reasons LE certs have two ways to root cert. For some reason(compatibility?) validation path with "DST Root CA X3" cert is preferred one. And, as far as I understood, curl is preferring its own set of root certs (instead of System ones) which are located at /etc/ssl/cert.pem. So removing stale root cert forces curl to use "ISRG Root X1"(if it's already there, ofc). NB! So, if you're doing it on a really old system you might have to do one more step - add this root cert to this file. Just be careful and get it from a trusted source.

Answer 5

According to https://observatory.mozilla.org/analyze/www.alternativalinux.it#tls, the site requires TLS 1.2 and Safari 5. I didn‘t find a technical documentation for Safari 4 but assume that it doesn‘t support TLS 1.2. TLS 1.2 needs code to handle it, a simple certificate update will not help here.

So you can‘t use Safari 4 any longer to connect to modern web pages.

Answer 6

I recently got a MacBook Pro with OS X 10.9. It also had SSL issues that I solved by installing Legacy Mac Proxy. Unfortunately, you can't install it on a PowerBook because the minimum OS X version required is 10.6, so i installed Squid, the proxy used in Legacy Mac Proxy, on my home server and now Safari works.

Answer 7

Complete answer for macOS 10.4.

First, download cacert.pem from https://curl.se/ca/cacert.pem (using a more modern machine)

Then, copy it over to your vintage Mac and run the following commands:

sudo cp cacert.pem /System/Library/OpenSSL/certs/cacert.pem
c_rehash /System/Library/OpenSSL/certs
sudo certtool i cacert.pem v k=/System/Library/Keychains/X509Anchors
sudo cp cacert.pem "$(curl-config --ca)"

However, Safari 4 does not support TLS 1.2, so many websites still won't work. Moreover, the version of OpenSSL on 10.4 doesn't support SHA256 signatures that many of these certs use, so e.g. curl doesn't really work with these. Luckily MacPorts still works on 10.4 (installing anything takes many hours as it needs to compile from source).

Answer 8

This is a small variation on the accepted answer. It didn't work for me on an old 10.15 macOS, as for some reason TMPDIR was not set in the script context. So i took some inspiration from this answer and changed the script to

#!/bin/bash

# DIR=${TMPDIR}/trustroot.$$
DIR=$(mktemp -d 2>/dev/null || mktemp -d -t 'mytmpdir')
echo creating ${DIR}
mkdir -p ${DIR}
trap "rm -rf ${DIR}" EXIT
cat "$1" | (cd $DIR && /usr/bin/split -p '-----BEGIN CERTIFICATE-----' - cert- )
for c in ${DIR}/cert-* ; do
   security -v add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "$c"
done
rm -rf ${DIR}

Which worked a treat! Kudos to the poster of the accepted answer