Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- apple [2022/01/07 21:42] – angelegt edvc
+++ apple [2022/01/16 23:56] (aktuell) – edvc
@@ Zeile 1: / Zeile 1: @@
 mac os lion root zertifikat erneuern:
-macOS, iOS etc
+https://mjtsai.com/blog/2021/09/24/some-web-sites-will-stop-working-with-el-capitan-and-older/#comment-3538503
-Some operating systems hold onto the expired R3 > DST Root CA X3 chain even if your server is no longer using it. Try a restart of the affected client device.
-For older macOS not updated by Apple:
+. Download this Root Certificate:
+--------------------------------------------
-Download the ISRG Root X1 certificate file from http://x1.i.lencr.org/
+NAME:
-Open the Keychain Access app and drag that file into the System folder of that app.
+"ISRG Root X1"
-Find the ISRG Root X1 certificate in System and double click on it, open the Trust menu and change "Use System Defaults" to "Always Trust", then close that and enter your password to confirm the change (if prompted).
+(✅ Self-signed, ❌ NOT Cross-signed)
+URL:
+https://letsencrypt.org/certs/isrgrootx1.der
+--------------------------------------------
+. Verify that the fingerprints match:
+--------------------------------------------
+So you know that the Root Certificate I've linked to is in fact the one that LE provides and Apple has certified/trusted.
+This is for *your* safety since you *shouldn't* trust me.
+FINGERPRINT (SHA-1):
+CABD2A79A1076A31F21D253635CB039D4329A5E8
+SOURCE:
+https://letsencrypt.org/certificates/ (Active > ISRG Root X1 > Self-signed > der)
+https://crt.sh/?id=9314791
+WHAT APPLE SHIPS 10.12.1+:
+https://support.apple.com/en-us/HT207189
+- Search for: "ISRG Root X1"
+You should see that the fingerprints match between and .
+--------------------------------------------
+. Install the certificate:
+--------------------------------------------
+- Via "Keychain Access.app"
+- `File > Import Items...`
+You can install it into either the `login` or `system` keychain. But not `System Roots` (which is where it *would* be, if we were on 10.12.1+)
+- login = Current user only
+- system = All users
+--------------------------------------------
+. Manually "Trust" that certificate:
+--------------------------------------------
+- Find it ("ISRG Root X1") in the list and double click on it.
+- Open the "▶ Trust" area.
+- Set: `When using this certificate:` to `Always Trust`
+- Close the window, which will ask you to verify with your login password.
+🏁 Done!