Why Do Older OS X and iOS Versions Need a Root Certificate Fix?

Updated

Older OS X and iOS versions ship with an outdated set of trusted root certificates. When a website or service presents a certificate chained to a root that the device doesn't recognize, the connection fails and the site or service won't load correctly. equinux publishes a configuration profile for Mac and iOS that adds the missing certificates; installing it restores access to affected sites and services. The fix is intended for devices running older system versions that predate the newer roots — if your device already loads those sites without errors, you don't need it.

What the fix actually does

A root certificate is the trust anchor at the top of a certificate chain. Browsers and apps accept a server certificate only if they can build a path from it to a root already stored in the system trust store. Apple updates that store through OS updates, so a device that hasn't been updated in a long time keeps trusting only the roots that existed when it was built.

equinux's fix is a configuration profile — a signed settings file that, once installed, adds the missing root certificates to the system trust store. It doesn't patch the OS or change how certificates are validated; it extends the list of roots the device trusts.

A concrete example: a device on an old OS X release tries to open a site whose certificate chains to a root issued after that release. The chain can't be completed, the handshake fails, and the site appears broken or unreachable even though the server is fine. After the profile is installed, the same chain resolves and the site loads.

Who should install it

Situation Install the fix?
Older Mac or iOS device where multiple sites/services fail to load with certificate errors Yes — this is the target case
Device already loads the affected sites normally No need
You can update the OS to a current version Prefer the OS update; it refreshes the trust store through Apple's normal channel
You only see an error on one specific site Check that site's certificate first; a single failure may not be a missing-root problem

How to install it

  1. Download the profile using Safari. equinux explicitly notes this: download the fix with Safari, not another browser.
  2. Open the downloaded file so the system adds it as a profile.
  3. Install it from settings. On Mac, go to the profile in System Preferences; on iOS, go to the profile in Settings, then choose Install.

After installation, revisit a site that previously failed. If it loads, the missing root was the cause.

Limitations to know before you start

  • No support is offered for this issue. equinux states the profile is provided as a convenience and that they don't offer support for it. Treat it as a self-service fix.
  • It is a stopgap, not a substitute for updates. The profile adds the roots equinux packaged; it does not keep the trust store current going forward. Devices that can be updated should be.
  • Trust-store changes are security-relevant. Installing a profile means trusting whatever roots it contains. Only install profiles from a source you're willing to trust, and remove profiles you no longer need.

About equinux.github.io

The site is equinux's small utility page for this certificate fix. equinux is a developer of Mac software — the page points to its VPN client for macOS (supporting IPSec, L2TP, OpenVPN, PPTP, SSTP, Fortinet SSL, SonicWALL SSL, and AnyConnect SSL VPN) and its Mac newsletter design tool, both offered as free trials. The certificate profile itself is the only thing this page distributes.