7

Recently, 3 of my older Macs (an old MacBook Pro, an older iMac, and an even older PPC tower) have started reporting that they can't establish a secure connection to many web pages. The messages may be worded differently, such as "this connection is not private" (with no option to continue).

I've tried the usual fixes without success. The only thing I can figure is that there has perhaps been an update to the TLS protocol that these older machines can't handle. Newer Macs don't seem to have a problem.

Does this sound possible? Is there any remedy?

Rob Lewis
  • 225
  • What macOS are they running? – lhf Oct 12 '21 at 00:07
  • See also https://apple.stackexchange.com/questions/428245/safari-could-not-establish-a-secure-connection-to-the-server – lhf Oct 12 '21 at 00:08
  • See https://apple.stackexchange.com/questions/422332/how-do-i-update-my-root-certificates-on-an-older-version-of-mac-os-e-g-el-capi/422333#422333 for how to update your certificates. – abligh Oct 12 '21 at 06:37

1 Answers1

5

The security certificates that these computers had when they were last updated have expired, leaving no replacement. Older versions of macOS (appears to be 10.11 and earlier) do not have the updated certificates.

You can try installing the new certificate manually following the directions on this page:

  1. Download the ISRG Root X1 certificate file from https://x1.i.lencr.org/

  2. Open the Keychain Access app and drag that file into the System folder of that app.

  3. Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).

https://docs.certifytheweb.com/docs/kb/kb-202109-letsencrypt/#macos-ios-etc

Warning: Installing Root Certificates should be done with extreme care. Doing this with a malicious certificate would subvert the security process your computer employs, since it means an attacker could cause your computer to trust malicious websites pretending to be websites you already use.

Here is a page by Let's Encrypt verifying the URL above to download the certificate is trusted: https://letsencrypt.org/docs/lencr.org/

Ezekiel
  • 9,125
  • 1
    The problem also affects macOS 10.11 El Capitan. – DarkDust Oct 12 '21 at 11:59
  • 1
    Great answer, but could you add a short blurb about the security implications of install root certs, only installing root certs that you trust, etc.? – Alexander Oct 12 '21 at 12:36
  • 1
    I already had the ISRG x1 cert on my Mac, but adding the R3 certificate fixed my problem. I was not so lucky on iOS. – tvanc Oct 29 '21 at 17:51