Q: Cannot access HTTPS urls; Safari hangs blank, crashes

First, I want to thank all of you for posting here. I really appreciate it.

To themask: I would never have thought of it being a problem with the X509 stuff. I know the Mac environment pretty well, but I have never seen any information that truly sets out what certificates and anchors are, how they function, and (most particularly) what to do to verify a certificate that Safari is not finding acceptable. However, the posts you pointed me to were informative enough that I tried various things to get the X509 files to reset or be replaced to the proper ones. Unfortunately, the stuff I did was not successful and things got even flakier. I did verify to my satisfaction that the problem at least began as a problem with one or more root certificates. Among the things I tried were reapplying the 10.4.8 Combo updater and getting replacement X509 files from another computer that was working properly, but it just wasn't any use in fixing the issue.

So I reformatted the disk and reinstalled everything. Nuking the disk may seem like overkill here, but a possible contributor to this problem is the fact that I had to replace my hard drive about a month ago and was not confident that the tech who replaced the drive reinstalled the OS fully and properly. It felt to me that the original X509 problem was cascading into other problems, until I just felt that reformatting was the only way to be sure I got all the bugs.

As far as I can tell so far, everything is back up and running normally.

Again, thanks to each of you for participating in this thread and helping me out. I consider the issue closed.

Steve



15 AlBookG4-1.25GHz Mdl-A1046   Mac OS X (10.4.8)  

15 AlBookG4-1.25GHz Mdl-A1046   Mac OS X (10.4.2)  

15 AlBookG4-1.25GHz Mdl-A1046   Mac OS X (10.4.8)  

From Ronnie the Snowflake (nice name! ):
"I experienced not being able to access HTTPS - Secure Sites this my Solution:
Go to Applications > Utilities: Open Keychain Access
Keychain Access > Preferences: 'Certificates'
Check - 'Online Certificate Status Protocol' (OCSP): OFF
'Certificate Revocation List' (CRL): OFF
Priority: OCSP (this will be greyed out)
Also check in Keychain Access the keychain 'X509Anchors' for any Certificates with a Red Cross beside them ...... highlight these and delete them (they are invalid).
Then Open Safari and access a Secure HTTPS Site."

I thought about doing something like this, but I simply don't know enough about protocols and certificates to understand what I would be doing. It seems to me that, in turning OFF these protocols, you are turning off the system's ability to verify certificates and therefore are eliminating the system's ability to authenticate your certificates, in which case your system is no longer able to recognize when a certificate has expired or for good reason becomes invalid or otherwise should not be trusted. It seems to me that this would degrade your SSL and other security protocols over time. I really have no clue on this but rather am making an assumption.

Perhaps someone can post a URI for an article that clearly explains anchors, certificates, protocols, and so on, in a coherent way, so I would have a better idea how to handle this kind of problem in the future.

Also, I might add that my problems with root certificates, etc., began shortly after I deleted a red-crossed root certificate for the first time in my entire life. I have no idea whether the issue I ended up having was related to that, although it would seem not, on theoretical grounds, yet (magical thinking) once-bitten, you know...

Further note that I did not apply Security Update 2006-007 until after I began having this problem, so the problem does not appear to have anything to do with that update.

Steve