2

On September 30, 2021, the DST Root CA X3 expired, and left macOS 10.11 and older unable to connect to any HTTPS servers which use Let's Encrypt by default. One easy way to fix this is to manually add the newer ISRG Root X1 certificate to Keychain Access and mark it as trusted.

Is it possible for a shell script to test for the presence and trust status of this certificate? If the certificate isn't present, I'd like to warn the user and direct them to possible solutions, such as the one above.

I want a solution which can work offline. Attempting to e.g. connect to a test website with curl seems unreliable, as the website could go down or there could be some other network misconfiguration.

How can I go about this?

1
  • 2
    Something like security find-certificate -a -c "DST Root CA X3" /System/Library/Keychains/SystemRootCertificates.keychain might work to see if it's present in system roots.
    – 1110101001
    Commented Nov 10, 2021 at 6:45

1 Answer 1

1

Thank you (again) to @1110101001 for the key hint I needed!

security find-certificate -c 'ISRG Root X1' will return an negative exit status if no certificate with that name exists in a Keychain. So:

if ! security find-certificate -c 'ISRG Root X1'
then
    # The certificate isn't installed.
fi

Unfortunately, this doesn't actually check if the certificate is trusted; we're assuming that if it exists, it's probably trusted as well. Until I can figure out how to check trust status, this will do for now.

You can even install the certificate for the user... this kind of feels like it shouldn't be allowed, but hey, that's not our problem and we're using it for a good cause?


if ! security find-certificate -c 'ISRG Root X1'
then
    if [ $(shasum -a 256 ./isrgrootx1.der | cut -d ' ' -f1) == "96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6" ]
    then
        sudo security -v add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./isrgrootx1.der
    fi
fi

The checksum step is a security precaution, to avoid installing a (potentially maliciously) modified copy of the certificate. It is by no means foolproof, but it's probably a good idea.

Please do also add a message to give the user some idea of what's going on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .