0

enter image description here

I reinstalled an old 2015 Apple computer today, and I ran into a few issues.

  • During system install, it failed because of some SSL issues, and I had to change the system's clock to prior 2017 for the install to work (got error "No package could be installed")
  • After install, things seemed smooth but many websites show a SSL error.

I checked the clock and it's correct. I checked the KeyChain "login" certificates and there are none that are invalid. I restarted.

I'm not sure how to fix that issue, it's weird that the computer says the certificate "will be valid 0 days from now" although it will expire in June 2022 (in 2 months).

Could there be another clock that is wrong?

2 Answers 2

2

My quick & dirty solution was to:

  1. Go to KeyChain Access
  2. View > Show Expired Certificates
  3. Select the "System Roots" Keychain, and the "Certificates" category
  4. Look up the certificate (DST Root CA X3)
  5. Double-click on the certificate, open the "Trust" section (collapsed by default) and apply "Always trust"

I applied the same operation for all "DST Root CA" certificates.

https://eclecticlight.co/2021/10/01/why-wont-safari-open-that-web-page/ explains a bit more in-depth the "whys" behind the actual issue.

N.B: This is not really secure.


Clean and proper fix

The best way to deal with this issue is to install a nother version of MacOS X. I eventually managed to install Monterey by going to the direct link in the App Store. From there, downloading and installing was a piece of cake, but because it didn't show in the "Updates" I thought this computer wasn't eligible.

1

The message

This certificate is not valid (expired root)

is a bit unclear. The reason that it is not accepted as valid, is not because that the certificate itself is expired but that the local copy of the root certificate involved in the trust chain for the certificate is expired (which should be able to be found if you go through the other certificates displayed)

In other words, your machine needs newer copies of the root certificates, which comes as part of security upgrades and new versions of MacOS.

Your machine is new enough that install all available updates from Apple as prompted (including new versions of MacOS) should fix the problem.

For others with machines that are old enough that "new enough" security updates are not available, the cure for web surfing is to install a HTTP Proxy server on another machine and configure MacOS to use it to access the Internet. The reason this works is because the https-traffic needing the certificates is handled by the proxy and the client just receives unencrypted trafic.

7
  • The computer is running OS X El Capitan. Surprisingly (to me), it doesn't allow me to download a more recent version of OS X. A bit earlier in the day, it proposed me to upgrade to another version (New Sierra, I believe) and I did, but after rebooting it was still on El Capitan. The KeyChain Access shows a lot of expired certificates in the "System Roots" section, indeed. Mar 27, 2022 at 16:45
  • I think it's related to this: eclecticlight.co/2021/09/21/… - This system is so old that it is outdated now apparently. Mar 27, 2022 at 16:46
  • Thanks to your explanation, I managed to find a good-enough workaround and wrote another answer. Mar 27, 2022 at 16:55
  • You're welcome. I learned something from your Quick and Dirty suggestion. I would suggest retrying the MacOS upgrade or create a MacOS Sierra boot media on another Mac and simply reinstall the machine. Mar 27, 2022 at 17:18
  • Yes! Indeed, I'm currently upgrading to the latest Mac OS version, somehow it was not proposed in the system upgrades, but by using a direct link to the latest version I was able to download it and it's currently installing. I hope it works and I can remove that dirty stuff which is rather insecure. Mar 27, 2022 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .