Software update is stuck on checking for updates on mac

Found this old tip from 2017 on StackOverflow and it fixed the issue for me right on.

The issue seems to be with the firewall of MacOS allowing incoming connections. Resetting the cache of accepted certificates fixed it. A reboot is required. Here are the steps:

By default, the built-in application firewall for macOS automatically allows applications signed by Apple to receive incoming connections. If you've adjusted the settings for your application firewall, you might need to allow incoming connections. If the issue persists, reset the cache of accepted certificates:

1. Click your desktop to make sure that you're in Finder.
2. From the menu at the top of your computer screen, choose Go > Go to Folder.
3. In the box, enter /var/db/crls/.
4. Click Go.
5. Drag the files labeled crlcache.db and ocspcache.db to the Trash.
6. If prompted, enter your administrator password.
7. Restart your computer, then try to connect to the iTunes Store, iBooks Store, or App Store.

dje4853 Said:

"Software update is stuck on checking for updates on Mac: [...]I have shutdown and rebooted numerous times, checked I have enough Ram and also checked Activity Monitor. Where to now? Thanks, Janet"

-------

Troubleshooting macOS Updating:

What to Try:

Perhaps there is an issue connecting to Apple's servers? So, try the following...

A. Updating in Safe Mode:

(Hold Down: the shift key upon boot). In Safe Mode, login items do not load at log in, certain System Preferences are set aside, and damages system files (caches) are fixed.

B. Single Out this User:

Try creating another administrator user and installing it through that user.

C. Restart your Router:

Perhaps there is an issue with the router's ISP connection? So, try restarting it.

E. Use a Different Network:

Are you using a public LAN (i.e. school network)? If so, you may be limited to only a certain amount of data use. So, using a private LAN.

It is always risky to follow blindly answers who don't analyze the core of a problem

and just suggests:

1. try this
2. try that
3. …

This is always a risk of damage for the blind follower.

And the lesson of this bug analysis is that all of these risky pieces of advice

would have been avoided if Software Update gave an intelligent error message

upon reading a corrupted certificates database.

To bet users are stupid and can't read error messages is causing a huge damage in the whole IT field.

It is a damage to trust.

I'm on Catalina 10.15.7 and have been having this exact same issue for at least two weeks now. I've tried all the suggestions and even tried to check for updates at a different location (using a different ISP) as well as tethering from my phone instead of my home ISP and I have the same issue. I've also tried using the terminal command "softwareupdate --list --verbose --product-types macOS,Safari --force" but it also fails to complete and isn't working.

I'm guessing this is an issue on Apple's update servers' end.

I had this problem come up on two different Macs {iMac (Retina 4K, 21.5-inch, 2017) and iMac (21.5-inch, 2017)} in the last week. Both were running Big Sur after the 11.6.5 update.

I tried a number of "try this" fixes, found here and elsewhere, none of which fixed the problem.

The fix for me was restarting in Recovery mode and reinstalling Big Sur.

My iMac was only spinning (hung) on Software Update for a couple of months and then suddenly I got it to work, perhaps by changing update settings (and earlier I still had BigSurBlocker running which I uninstalled and didn't seem to be it). Software Update worked just long enough to allow for updating of Catalina and Safari and then it went into the forever running and going nowhere mode again.

A week passes, still only spins.

So (as suggested above), I deleted /library/preferences/com.apple.SoftwareUpdate.plist, which seemed not to work (maybe I should have done a restart). And I should have made a copy of it, but I didn't.

Then (as elsewhere described above) I deleted /var/db/crls/clrcache2.db (with a 2, and the only db file there) and then I did the restart.

Hallelujah!!! Fixed for now - if it happens again, I'll delete one at a time with restarts.

Advice: Make a copy of any file you are deleting and restart, one delete at a time.

To follow-up from yesterday's post. The problem file (for at least some of us) must be the crl cache file. When I booted my iMac today, it went back to endless spinning on Software Update. After running Software Update, the crl cache file (and the SoftwareUpdate.plist file if it's also missing) are recreated. The newly created crl cache file apparently will have the same issue impacting subsequent Software Update attempts. However, when I initially deleted crlcache2.db yesterday, and restarted, I successfully ran both Software Update and the SilentKnight.app which checks for Apple security updates - and both ran and completed when they otherwise haven't been. I don't know what to make of that since running Software Update twice in a row (after deleting the crl cache and restarting) doesn't succeed on the second running of Software Update.

I'm only able to do a little bit of research now. I did recover, from Time Machine backups, older copies of my crlrcache2.db file, (and same for com.apple.SoftwareUpdates.plist which I now suspect is uninvolved) should I ever come across a way of inspecting these. More importantly, CRL stands for certificate revocation list and concerns SSL certificates. Unfortunately, I do not know enough to give a proper explanation, and exactly how this impacts Software Update with no message given to this sorry user. It appears I have an SSL certificate to straighten out but I have no idea what it could be. I'll guess I did something to make this happen.

There is a terminal command, "crlrefresh rpv", that does nothing for me, and even with v (verbose), it runs silently. I'll guess it's because the cache created is always crlcache2.db and not crlcache.db, so it does nothing.

I hoping that someone comes along here and knows enough to explain the CRL and what might be going on and how to fix the certificate problem if that's what it is. I know how to get Software Update to run once when I really need to now, I can't afford to spend a lot of time on this. Oh by the way, a month ago I found the link to manually download the Catalina security updates I was missing and I did so. However, when trying to install the updates, the installer goes into an infinite loop just like Software Update does. Obviously, the CRL cache creates more potential problems than just with Software Update checking. There's a serious bug in the way all this is being handled. There shouldn't be any infinite looping when there is an obvious problem that can be detected in Apple software and reported in some manner to the victimized user.

This has gotten ridiculous and I don't know if I should delete everything I've written already or not. After I read what I wrote above, I realized I might rename crlcache2.db to crlcache.db and run "crlrefresh rpv" again and again nothing was displayed and nothing worked. And crlcache2.db is going to be created automatically regardless. But what kills me is that even with deleting the crl cache, I could not get Software Update to work again despite multiple tries and restarts --- perhaps invalidating what I wrote was a temporary solution. Enough to drive one crazy. I even went back to trying to delete both the cache and the com.apple.SoftwareUpdate.plist before a restart. Still no worky. All I know is this: if com.apple.SoftwareUpdate.plist is missing, it will be recreated on restart and will exist before running Software Update, and, if clrcache2.db is missing, it will be recreated immediately by Software Update on its starting.

The only other thing I was doing was sometime closing a popup menu from SwitchResX (a preference pane for managing screen resolution) that comes up on startup saying that it won't save settings because I haven't paid although I can keep using it. (I didn't care about SwitchResX because I only tried it for when I used Air Play with my Roku but my fairly new high-end Roku had a very short life with Air Play before its Air Play broke and Roku support and company failed in every possible way. ) So I uninstalled the SwitchResX preference pane, and deleted the crl cache and even that plist file again. And restarted. Software Update just infinite spins as usual. So I restarted again without touching or deleting anything this time. So it was two restarts after one clean. To my surprise, Software Update now worked again. What,,,, this is crazy crazy. So I wrote this here (final?) update post. Let me try Software Update again right now before I leave to see if it will run it twice in row ....................................... After closing the preference panes, I got Software Update to start again from scratch, and .... same old infinite spin. I give up claiming to know anything.

Here's more (...continued). I startup my iMac early this morning May 18, 2022. I check Software Update and it goes into an infinite loop yet again (waiting for something that never happens - I know from experience that if it doesn't return with info after a short while, it never will - no matter how long it's left running - there's never been an exception).

So I delete /var/db/crls/clrcache2.db yet again, and restart. I run Software Update and it comes back with info: MacOS Monterery is available (no thanks, I staying with Catalina for a while yet) and there are no other updates (there's an extremely slight chance there was and I didn't read right). I am expecting an update for Catalina because there was one on May 16, but I don't see it. Ok, maybe Apple isn't distributing it to everyone yet. I run the SilentKnight.app mainly to see if it can do its Apple security update check. It can't finish - if you've been reading, Software Update (when I get it working) generally only works once. (After worky, I quit the Preference Pane and try again and it hangs - likewise for SilentKnight when I've tried.)

I restarted without deleting the crl cache, and try to run SilentKnight and Software Update. Both hang on checking for updates. I restart again without deleting the crl cache, and again, only hangs.

I think I deleted the crl cache and restarted and checking for update hung.

I leave Software Update running (when it's hung) and restart. My iMac is set to reopen windows. On restart, without any action from me, the Software Update preference panel is displayed and it's already completed: It says Monterery is available (no surprise) but now it says there are other software updates which are the May 16, Catalina security update and the Safari 15.5 update (I was already aware that Safari 15.5 was out for Catalina and I was still on 15.4.) Great! It seems that if I try hard enough, with all the tricks (which for all I know for sure, could be just superstition), I can eventually get updates installed. At least for now.

So the latest trick could be, although it definitely might not be, leave Software Update running (when hung) and do a restart. If you have selected the option to reopen windows on restart, and this is a valid trick, then lucky funky hunky dory.

Final note: Although days ago I had finally been able to update Catalina for the first time in months, I know I didn't have the May 16 update because my build number (which is displayed when you click on the version number in About This Mac) was not the latest (real example: 10.15.7 (19H1824)). The only place I know of that lists, and might have, the latest build number is the Wikipedia page specifically for individual macOS versions. Catalina in my case. And the May 16 build number is 19H1922. My build number 19H1824 is dated March 14.

Since my Software Update has now remained always working for a couple days, a couple shutdowns, and a couple restarts, I'm hoping the May 16, 2022 Catalina update has fixed my iMac's Software Update problem. One person above, besides me, was also having the problem with Catalina. Group solving this may have been far better had all stated their macOS.

This latest May 16, 2022 Catalina update also holds hope because included in its documentation are these items that were worked on:

SoftwareUpdate

Available for: macOS Catalina

Impact: A malicious application may be able to access restricted files

Description: This issue was addressed with improved entitlements.

CVE-2022-26728: Mickey Jin (@patch1t)

OpenSSL

Available for: macOS Catalina

Impact: Processing a maliciously crafted certificate may lead to a denial of service

Description: This issue was addressed with improved checks.

CVE-2022-0778

"analyze the core of a problem" - that's a good one!!!

I never wanted to spend any time on this but I got sucked in out of necessity. I have no time, especially to reinstall the OS. Eventually, I would have tried updating to Monterey and prayed that would succeed. I could talk software engineering with you forever since I was a software engineer for decades and have combed through more logs more than anyone ever wants to. But - great idea.

Before logging out, I thought I would try Software Update one last time since it had worked ten times in a row and I was hopeful. But this time it stuck. So I left it running and restarted. It worked. I quit the Preference Pane and ran it again. It worked. Well I'm better off than I was.

I grabbed some lines out of the system.log. Most of the Software Update segments look like the following and unfortunately don't help me (other unrelated errors are similarly reported). Certificate appears on one line a few times and I included a sample of that too. I am logging out for good for awhile but I'll check back when I can.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUReachabilityMonitor is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUPrinterScan is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUSignedFlatPkg is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUPowerAssertionManager is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUPowerSourceMonitor is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class SUURLConnection is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 04:32:36 supercomputer suhelperd[483]: objc[483]: Class KeychainMasterHandler is implemented in both /usr/lib/libIASAuthReboot.dylib and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd. One of the two will be used. Which one is undefined.

May 20 02:16:26 supercomputer akd[425]: objc[425]: Class AKCarrierBundlePhoneCertificate is implemented in both

In the case described here,

softwareupdated

is already running.

The core of the problem is that it doesn't detect a corrupted CRL or CRL cache.

I think a

sudo launchctl kickstart …

will just restart the fool on its job from the beginning.

I’m not sure about all that, all I know is that command when run on a machine where all you are getting is the endless “checking for updates” symptoms, results in a successful check and any available updates can be selected for install.

Maybe someone smarter than me can explain why that is the case ;)