Many sites are displaying SSL Certificate invalid but their date is in the future and the computer's clock is fine

Question

I reinstalled an old 2015 Apple computer today, and I ran into a few issues.

• During system install, it failed because of some SSL issues, and I had to change the system's clock to prior 2017 for the install to work (got error "No package could be installed")
• After install, things seemed smooth but many websites show a SSL error.

I checked the clock and it's correct. I checked the KeyChain "login" certificates and there are none that are invalid. I restarted.

I'm not sure how to fix that issue, it's weird that the computer says the certificate "will be valid 0 days from now" although it will expire in June 2022 (in 2 months).

Could there be another clock that is wrong?

Answer 1

My quick & dirty solution was to:

1. Go to KeyChain Access
2. View > Show Expired Certificates
3. Select the "System Roots" Keychain, and the "Certificates" category
4. Look up the certificate (DST Root CA X3)
5. Double-click on the certificate, open the "Trust" section (collapsed by default) and apply "Always trust"

I applied the same operation for all "DST Root CA" certificates.

https://eclecticlight.co/2021/10/01/why-wont-safari-open-that-web-page/ explains a bit more in-depth the "whys" behind the actual issue.

N.B: This is not really secure.

---

Clean and proper fix

The best way to deal with this issue is to install a nother version of MacOS X. I eventually managed to install Monterey by going to the direct link in the App Store. From there, downloading and installing was a piece of cake, but because it didn't show in the "Updates" I thought this computer wasn't eligible.

Answer 2

The message

This certificate is not valid (expired root)

is a bit unclear. The reason that it is not accepted as valid, is not because that the certificate itself is expired but that the local copy of the root certificate involved in the trust chain for the certificate is expired (which should be able to be found if you go through the other certificates displayed)

In other words, your machine needs newer copies of the root certificates, which comes as part of security upgrades and new versions of MacOS.

Your machine is new enough that install all available updates from Apple as prompted (including new versions of MacOS) should fix the problem.

For others with machines that are old enough that "new enough" security updates are not available, the cure for web surfing is to install a HTTP Proxy server on another machine and configure MacOS to use it to access the Internet. The reason this works is because the https-traffic needing the certificates is handled by the proxy and the client just receives unencrypted trafic.