0

I'm at my parents house for the holiday period, and they've just revealed to me they've been getting this error every time they visit their banks website in Chrome (ERR_CERT_AUTHORITY_INVALID)

They have a late 2007 MacBook running Snow Leopard 10.6.8

I believe this is because the certificate authority "Entrust Root Certification Authority - G2" that the banks cert has been signed with is not in their System Roots keychain.

Am I correct in thinking this is because Apple are no longer issuing updates for OSX 10.6.8, so any new System Root certificates won't arrive?

The only "workaround" I've been able to offer them, outside of throwing the MacBook in the bin, is to make them use Firefox instead as that doesn't use the OSX keychain. But they're so used to Chrome, it's going to be a pain explaining to them the change.

Any other workarounds anyone can think of?

  • What is the website they are trying to get to? – Tim Dec 29 '15 at 14:06
  • tescobank.com/sss/auth - it looks like they changed their root on the 22nd October, which has caused this. – djhworld Dec 29 '15 at 14:35
  • the site loaded perfect for me with that new cert issues on the 22nd. The mac is probably trying to use the old one it has cached. Go to keychain, and see if you can find the old one under system. then remove it. – Tim Dec 29 '15 at 15:23
  • I had a look unders system but it wasn't there under "Login", "System" or "System Roots". On my Mac (running el capitan) I can see it under "System Roots", leading me to believe it probably came by a system update – djhworld Dec 29 '15 at 16:00
1

Chrome support is ending for 10.6 in April. They will either need to update to 10.9 or use a different browser such as firefox to try and stay secure.

Try opening the page in incognito mode

Open the page in an incognito window. If it works there, it means one of your extensions is causing the security problem and you should remove it. Learn how to turn off an extension.

Temporarily turn off your antivirus (if applicable)

If you have any antivirus software on your computer that provides "HTTPS protection" or "HTTPS scanning," it might be interfering with the browser's ability to provide security. Turn it off for now to see if it fixes the problem. If that works, you'll need to turn off this feature to use secure sites. Remember to turn it back on.

Updates

Make sure Chrome is updates as well as the Mac itself.

Clear Certificates

Go to Utilities-Keychain In system, find the old cached key and remove it. Should be under system and not system roots.

  • Sadly their Mac is a late 2007 edition MacBook, they can't upgrade to any of the newer operating systems as Apple don't support it. – djhworld Dec 29 '15 at 14:00
  • Well darn. What version of chrome is installed? It is possible that an out of date chrome wont allow it. The biggest cause to this issue is the website using a weak/outdated method of cryptography. – Tim Dec 29 '15 at 14:59
  • I don't have the laptop to hand, but it's in the latest version (47.x) and I checked to see if there were updates available - which it said it was the latest version. The problem is Chrome uses the OSX keychain to manage certificates, whereas Firefox has its own keystore. – djhworld Dec 29 '15 at 15:18
  • Also I tried the incognito mode trick to make sure it wasn't extensions or anything interfering, but same issue. They don't run antivirus. As a temporary measure I went to the Entrust website and downloaded/installed then trusted the certificate myself, but I don't believe this is a good idea to be installing root certs in your user keychain! I think problem is this Root CA is a recent one that would normally come with OSX updates - but Apple don't provide updates for snow leopard anymore. – djhworld Dec 29 '15 at 15:23
1

You could upgrade them to Lion, which is still current and supported.

If they will not update the OS, and you know the certificate, why not download the current root cert (from here) and install the cert.

  • I took the secondary action and installed the root CA in the end, but this is a hack imo, I don't believe it's appropriate to be installing root certs yourself! In the meantime I'm going to give my parents my 2011 MacBook PRO as Apple still support that – djhworld Jan 12 '16 at 13:07

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.