Note this copies over the first group of certificates ( 'Trusted Certificates' in the question), but not the second nor the third. In case you were wondering, you cannot add them to the System Roots keychain as that can only be updated by the operating system. pem file into a number of certificates in the temporary directory concerned, then adds them as trustRoot certificates to the System key chain they will then operate as trusted roots in addition to the certificates in the original 'System Roots' keychain. Security -v add-trusted-cert -d -r trustRoot -k '/Library/Keychains/System.keychain' '$c' by copying it into a file, then using chmod 755 trustrootĬat '$1' | (cd $DIR & /usr/bin/split -p '-BEGIN CERTIFICATE-' - cert- ) Make the trustroot shell script below, e.g.

Copy the rootcerts.pem file to your antique mac.

This file will contain all the certificates concatenated.

On that Mac, launch Keychain Access, select 'System Roots', select all the certificates, select File->Export, and export them as rootcerts.pem file.

that can access the problematic web sites)

First find the more modern Mac with a working set of System Root certificates (i.e.

(Why not just download them? See note that the end of this answer.) The easiest way to do this is to transfer your System Root certificates from another Mac to which you have access that runs a more modern version of macOS. How do I update my root certificates on an older version of OS X 10.11 There is a list of fingerprints of the current certificates there, but no downloadable bundles of certificates.

Blocked certificates are believed to be compromised and will never be trusted.

When one of these certificates is used, you'll be prompted to choose whether or not to trust it.

Always Ask certificates are untrusted but not blocked.

When IT administrators create Configuration Profiles, these trusted root certificates don't need to be included.

Trusted certificates establish a chain of trust that verifies other certificates signed by the trusted roots - for example, to establish a secure connection to a web server.

This seems to be because Safari and Chrome use the OS root certificate store and Firefox uses its own, and El Capitan is not being updated. They also work on newer versions of macOS (e.g. They work on Firefox but not Safari or Chrome.

They give me a certificate expired error.

I have difficulty reaching various secure web sites.

Update mac os x 10.6 8 to high sierra