Connecting legacy Mac OS (10.3.9) to modern HTTPS via TLS

Question

I'm using an old iMac G3, running Mac OS 10.3.9 Panther, for research purposes. My concern is not security - I don't put sensitive information on this machine, nor do I mind if the integrity of the Operating System is compromised. I just want to be able to connect to the internet for benchmarking purposes. I am aware that the specs of this machine are too low to run most websites.

As you're probably aware, the SSL security protocols on this version of Mac OS X are out of date enough to prevent me from visiting anything aside from Google.

One step I've taken care of is following the directions from How do I update my root certificates on an older version of Mac OS (e.g. El Capitan)? :

Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.

For older macOS not updated by Apple:

Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/ Open the Keychain Access app and drag that file into the System folder of that app. Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

I seem to be able to connect to Google via HTTPS, which is a step up, but sites like Wikipedia still prevent me from accessing them for security reasons. What else could I try doing in order to get this computer on the internet (for better or worse)?

Answer 1

As you noted, the problem is that your OS X does not support modern versions of the SSL protocol, such as TLS 1.2. Wikipedia, like many modern websites, does not support older versions of SSL. This creates an impasse where neither can talk to each other. Updating root certificates won't help, because your Mac and the server do not speak the same language.

Instead, you need a translator—a piece of software which sits between you and the server, intercepts your traffic, and modifies it to be compatible. This is called a "man-in-the-middle" or "MiTM" proxy server. The proxy will decrypt and re-encrypt your traffic before sending it on its way.

For Macs running at least OS X 10.6, I created a turn-key solution to set up a local MiTM proxy server: https://jonathanalland.com/old-osx-projects.html. However, this won't work on OS X 10.3. Unfortunately, I don't know of any MiTM proxy software that will run on your OS.

So, what you have to do instead is set up an MiTM proxy server on a second device, such as a Raspberry Pi or a modern PC, and then connect to that proxy from your old Mac.

Because this involves networking multiple machines, exact instructions will depend on your setup, but it can work! Although the proxy server on the page linked above requires OS X 10.6, you may still want to reference the Squid configuration file included in the package as a starting point.

---

^{P.S. And even if your OS supported modern protocols, there would be the issue of cipher suites! My OS, OS X 10.9 Mavericks, supports TLS 1.2. However, I cannot connect to Wikipedia without my proxy server, because Mavericks lacks support for modern cipher suites, and Wikipedia does not support older cipher suites.}