Welcome to the MacNN Forums.

dowNNshift · Mar 18, 2007, 01:08 AM

OK... I am stumped. I cannot get Safari 2.04 to load any SSL (HTTPS) secure web page. Nope, not even Apple or GeoTrust's secure HTTPS pages either.

I have a new MacBook C2D with 10.4.9 installed. No fancy third-party firewall apps or proxy servers. Oddly enough, secure HTTPS pages do (thankfully) load with Firefox.

So far I've...

1. Tried booting into Safe mode, still no success.
2. Repair Disk Permissions using Disk Utility, no change.

Any one have a fix that doesn't require wiping the drive? That'd be a bummer considering all the time spent loading software and configuring everything.

Thanks in advance!

Big Mac · Mar 18, 2007, 01:13 AM

What happens when you go to a secure site? Page come up blank? Error?

dowNNshift · Mar 18, 2007, 10:00 AM

Yep, it shows an error and refuses to show the page.

"Safari can’t open the page.
Safari can’t open the page “https://www.geotrust.com/” because it couldn’t establish a secure connection to the server “www.geotrust.com”."

JKT · Mar 18, 2007, 10:25 AM

Apple - Support - Discussions - HTTPS Problem ...

Try deleting the com.apple.security.revocation.plist file from ~/Library/Preferences

dowNNshift · 02:22 PM

No such luck, tried that last night before I turned to this forum.

I've exhaustively searched for articles over at support.apple.com, with no luck other than to do an archive and re-install. I'd like to consider that a last ditch effort.

Is anyone else with 10.4.9 having this problem too?

dowNNshift · Mar 18, 2007, 02:19 PM

I figured it out!

After doing some troubleshooting, I isolated the problem to Keychain.

First I opened up Keychain First Aid and did a verify and repair, which output " Keychain /System/Library/Keychains/X509Anchors appears to be damaged"

So I copied the X509Anchors file from another working Mac here on-site and replaced the messed up file. Again I ran another Keychain First Aid repair, and viola all better.

I guess during the 10.4.9 update the X509Anchors file got corrupted. In the future I'm gonna keep a clean working copy of that file for backup.

So the lesson here... Safari uses the certificates function of Keychain more closely than a third-party browser such as FireFox. Hopefully this will help someone else in the future!

-dowNNshift

Shamooo · Mar 20, 2007, 10:16 PM

Originally Posted by dowNNshift

I figured it out!

After doing some troubleshooting, I isolated the problem to Keychain.

First I opened up Keychain First Aid and did a verify and repair, which output " Keychain /System/Library/Keychains/X509Anchors appears to be damaged"

So I copied the X509Anchors file from another working Mac here on-site and replaced the messed up file. Again I ran another Keychain First Aid repair, and viola all better.

I guess during the 10.4.9 update the X509Anchors file got corrupted. In the future I'm gonna keep a clean working copy of that file for backup.

So the lesson here... Safari uses the certificates function of Keychain more closely than a third-party browser such as FireFox. Hopefully this will help someone else in the future!

-dowNNshift

Well dowNNshift, I really do think that this latest update has completely screwed my keychain as well. Same symptoms....Can't open any secure sites at all. The only thing is, my entire keychain entries are now gone. I can't seem to recover them. My x509anchors file is there but i'm assuming it is corrupted or keychain cannot read the entire file. Is there any way to recover from this really really nasty apple update error?
Thanks

dowNNshift · Mar 20, 2007, 11:16 PM

Frustrating stuff!

Have you run Keychain First Aid? Try that first to see how bad the corruption is.

10.4.9 update got my Keychain pretty messed up, so the only way I was able to repair the Keychain was to copy an unaffected X509Anchors file from another working Mac here on-site onto my MacBook. The other option was to completely wipe and reload, which I wasn't to thrilled with.

As far as your current X509Anchors file, if it is corrupted then the data in it is likely not very recoverable -- as mine wasn't.

An idea, if you don't have access to another Mac but do have an external FireWire hard drive, you could install Mac OS X on the FireWire drive to get a clean X509Anchors file to repair the corrupted one on your current system drive. After the repair is complete, just erase the FireWire drive.

Hope this helps!

-dowNNshift

Shamooo · Mar 21, 2007, 12:12 AM

Originally Posted by dowNNshift

Frustrating stuff!

Have you run Keychain First Aid? Try that first to see how bad the corruption is.

10.4.9 update got my Keychain pretty messed up, so the only way I was able to repair the Keychain was to copy an unaffected X509Anchors file from another working Mac here on-site onto my MacBook. The other option was to completely wipe and reload, which I wasn't to thrilled with.

As far as your current X509Anchors file, if it is corrupted then the data in it is likely not very recoverable -- as mine wasn't.

An idea, if you don't have access to another Mac but do have an external FireWire hard drive, you could install Mac OS X on the FireWire drive to get a clean X509Anchors file to repair the corrupted one on your current system drive. After the repair is complete, just erase the FireWire drive.

Hope this helps!

-dowNNshift

First let me say thanks for your help.
Now, I can't believe apple would not have tested this update thoroughly enough to not have caught this. I am very sure that we are not isolated events.
The other thing is when you imported another x509anchors file, i'm assuming replacing the old one, were you not able to recover any data from your original before hand? I had over 50 usernames and passwords in there that are now gone....... I tried the first aid originally but to no avail. Then i did a reset which just "moves" the old keychain. Now here I am.......

Any ideas?

Shamooo · Mar 21, 2007, 06:03 PM

Hello again dowNNshift. I know this is going to sound a little unorthodox, but i was wondering after you have resolved your x509anchor file issue, is there anyway I can ask you to perhaps send me a clean file? I got in touch with apple and spoke with them at length regarding this issue and in the end, they basically told me to (go *^&%) and archive and install. That there is no other way to fix the problem even after I had mentioned your success. Problem is, I have 13 machines in the office that took the upgrade and are all doing the same thing. Apple didn't really care and (illogically) thought that these were isolated incidents. Please let me know.
Thanks

Shamooo · Mar 21, 2007, 08:36 PM

Got a hold of a clean X509Anchors file and like you said... perfect. I really would have expected a little more from apple though.
Cheers

dowNNshift · Mar 21, 2007, 10:09 PM

Awesome -- glad you got it fixed. Beats the heck out of Archiving and re-installing!

Happy to help

Catenaria · Apr 6, 2007, 09:03 AM

Hi all,

My system got corrupted as well. Unfortunately, I do not have the option to installing OSX on a Firewire or USB disk simply because I have neither... Needless to say, reformatting is not an option either. (This seems so Windows-ish...)

Could some of you send me the X509Anchors file? I would greatly appreciate it. E-mail is lcordeiro at hotmail.com

Thanks and have a great Easter everyone...

zakiu · 08:59 AM

ima take a dump

jbuerge · May 22, 2007, 10:42 AM

Happy to have found all of the posts regarding the X509Anchors problem. My corruption of the file and access to secure sites was lost (it seems) when I Synced with dot mac for my G5 an G4 lap top and unfortunately allowed the keychain to be included.

First Aid/Repair shows the X509Anchors as corrupted, but with no ability to fix. The lap top's file is OK. My Keychain Access application Panel shows X509Anchors with a hollow icon and locked with no provision to unlock it.

If there is a recommendation that I use the laptop X509Anchors file, then please, with what path do I find it, and how do I replace the corrupted one?

I am a first time user of this forum. Thanks for the good information collaboration.

jbuerge · May 23, 2007, 05:24 PM

Originally Posted by dowNNshift

Awesome -- glad you got it fixed. Beats the heck out of Archiving and re-installing!

Happy to help

I don't know if you can help me or not, but I got onto the end of a blog about the X509Anchors problem and added the following - but not active evidently.

Happy to have found all of the posts regarding the X509Anchors problem. My corruption of the file and access to secure sites was lost (it seems) when I Synced with dot mac for my G5 an G4 lap top and unfortunately allowed the keychain to be included.

First Aid/Repair shows the X509Anchors as corrupted, but with no ability to fix. The lap top's file is OK. My Keychain Access application Panel shows X509Anchors with a hollow icon and locked with no provision to unlock it.

If there is a recommendation that I use the laptop X509Anchors file, then please, with what path do I find it, and how do I replace the corrupted one?

I am a first time user of this forum. Thanks for the good information collaboration.

dowNNshift · May 23, 2007, 11:36 PM

jbuerge -- Happy to clarify....

The only way to repair the corruption to the X509 Anchors file is to copy a working one from another Mac OS X v10.4 machine, in this case your PowerBook.

Using your finder on your PowerBook, navigate to the /System/Library/Keychains/ folder and copy the X509Anchors file and save it to a removable media of your choice (iDisk, Flash card, iPod). Then connect the removable media to your affected machine(s) and over-write the bad X509Anchors file with the good one.

** Just be mindful to COPY and not MOVE the good X509Anchors file from your PowerBook...

Be sure to run another Keychain repair within Keychain Access -- then you should be again able to access SSL webpages normally.

bobo42 · Jun 14, 2007, 06:35 PM

I might have the same problem..I can send email but
cannot attach file or picture?

So I did a the Keychain Repair...

Repair started
Checking keychain configuration for XXXXXX (user ID=XXX)
Home directory is /Users/XXXXXX
Checked login keychain
Checked default keychain
Checked keychain search list
Keychain search list not properly configured
Rebuilt keychain search list
Checked contents of ~/Library/Keychains/XXXXXX
Checked contents of ~/Library/Keychains
Unable to open ~/Library/Keychains (-25295)
Checked contents of ~/Library/Keychains
Unable to open ~/Library/Keychains (-25295)
Checked contents of ~/Library/Keychains/Microsoft_Intermediate_Certificates
Checked contents of ~/Library/Keychains/login.keychain
Warning: some problems were not fixed
Repair failed

What do I do now??

Help

bobo

salvokat · 01:12 AM

I hope this isn't rehashing old issues.. and I'm new, so don't bite!

BUT... I can't find the said x509 Anchor file.
I've looked in the Library/Keychains folder and all I have in there are
FileCaultMaster.cer
FileVaultMaster.keychain
System.keychain

Am I looking in the wrong place?

I have a "clean" iBook that SSL sites work on, but I also have a brand new iMac, with the SSL problem.

Thanks in advance for anyone's help with this.

dowNNshift · Jun 19, 2007, 04:04 PM

salvokat -- Welcome! I think you're looking in the /Library folder instead of the /System/Library folder.

The correct file path: /System/Library/Keychains/X509Anchor

Copy that good clean X509Anchor to the affected on on your iMac (also is a good idea to keep a clean one in a safe place as a backup too). Then run key chain first aid as described in one of my posts above.

Good luck!

salvokat · Jun 21, 2007, 03:01 AM

thanks! I hope I can make it work now when I go back into work to use the iMac.

Woohoo!

salvokat · Jun 26, 2007, 10:14 PM

so It didn't work

I replaced the "bad" file with the "good" one, and then restarted, then "repaired" Keychains access, then reset Safari and STILL it's not working.

But, one interesting fact is that there is ONE SSL site that I know works, while all of the others dont, and I have no idea why.

Would it have anything to do with the internet security settings, or are these all tied up in Keychains anyway.

I'm so lost

Thanks for your help and so far, and thanks in advance for anything you can add. I'll keep searching around for a while and see what I can come up with.

salvokat · Aug 13, 2007, 09:00 PM

I've still not been able to get anywhere with this problem.

Is there any insight that ANYONE can bring?

dowNNshift · Aug 13, 2007, 09:38 PM

This is a problem caused from Key Chain corruption. Did you copy a clean X509Anchor file? If it isn't a new, clean X509 Anchor file then it won't work. Did you reset your keychain?

I've done this fix on several machines without a hitch... so rest assured that it works.

Do you have AppleCare? If you do, then you can call phone support and they'll walk you through a solution -- or you can visit a local Apple Authorized Service Provider or Apple Store Genius Bar and get assistance too.

Worst case scenario, you can backup all your files and settings and re-install Mac OS X.

salvokat · Aug 14, 2007, 12:58 AM

I did attempt to replace the corrupt file with the clean one that I have, but it hasn't seemed to make any difference.

I'll try with AppleCare, thanks for the heads up.

I'm beginning to think that it might be a server problem, because there is ONE SSL site that is working fine.

Sorry, that didnt make much sense, but thankyou so much for your help.