iCloud login problem on Sierra, High Sierra? Try this.

Download the Apple Intermediate Certificates

Apple IST CA 2 - G1 - This is a download link, the certificate will appear in your downloads folder.

• Double click the downloaded certificate to install it in Keychain Access.

Try to log in to iCloud after that, should work.

Open Keychain Access, In Keychain access menu bar go to View/Show Expired Certificates. 

Double click on the Apple IST CA 2 - G1 Certificate, 

Expand Trust option, 

When using this certificate: Select "Always Trust".

Restart the Mac.

Done!

So the dreaded day has come, the certificate has expired (as announced previously) and I'm right back to where I started.

iCloud has stoped working again.

SOLUTION: Open Keychain Access, Double click on the Apple IST CA 2 - G1 Certificate, Expand Trust option, When using this certificate: Select "Always Trust".

Restart the Mac.

Done!

Just got off the phone with apple Canada support 2nd level engineering. the agent checked his Mac running Monterey and found the same expired certificate.

Summary:

As of May 16, 2022 older versions of OSX can not use iCloud notes… (some, sort of, maybe).

Reason given is that newer OSX have the ability to request the latest certificate and the older don’t.

The issue is not the certificate itself but that the Apple Server will not no longer issue certificates to older OSX (implemented silently May 16).

There will be no update to the downloadable version of AppleISTCA2G1.cer for security reasons.

Apple service supports the latest three versions of OSX that any particular Mac can run.

My MacBook Pro 15” from 2012 is running OSX10.13.3 so it might be within the latest support bracket if I update to OSX10.13.6. The agent could not confirm that updating would fix my problem.

Older versions of OSX are not updated with the latest in Apple’s security features so they can no longer run with iCloud notes unless it is the highest OSX version for that particular Mac… (some, sort of, maybe).

Given all the some, sort of, maybes from Apple I’m gonna wait till Tuesday to see if Apple fixes this anyway.

Finally found what worked for me: (OSX10.13.3)

In Keychain Access:

Set these to “always trust”:

-original "Apple IST CA 2 - G1”

(AppleISTCA2G1.cer)

expired 20220520

Showing in the Keychain column “Login”

-second "Apple IST CA 2 - G1”

(appleistca2g1_bc.cer)

expires 20250507

Showing in the Keychain column “Login”

-“GeoTrust Global CA"

expired 20220520 (when I did this to the one I found a second identical appeared)

Showing in the Keychain column “System” and/or “System Roots”

I set them last night and they still work this morning.

Just update the Apple IST CA 2 - G1 cert from the Apple PKI (Apple PKI - Apple) site as pedrocaino said.

I did nothing else on my Sierra installation (I did not use 'Always Trust' anywhere) but install this new cert. I then logged out of iCloud and then back in without issue. Note that I only use iCloud for Notes.

Solution: Additionally You had to Trust the Root Certificate of Geo Trust which is used in Apple IST CA 2 - G1

The signing Root CA "GeoTrust Global CA" in "System Roots" expired on May 21, 2022.

So set both the original "Apple IST CA 2 - G1" and "GeoTrust Global CA" to "always trust"

This works for me in High Sierra !!!

Notes, Safari, iCloud drive,... now syncing again (reboot not necessary)

puh....

Certificates link above in 13 Apr post by dgd. I was running Sierra on MBP and it worked for me after rebooting with new cert. I still have loads of expired certs, I just ignored them.

I just installed "AppleISTCA2G1.cer" expiration date 20250506.

I did not change anything else from my previous large post on the other certificates.

Works so far.

I found my Keychain Access was unlocked. Should it be locked for normal operation?

Th below .cer worked on my Mac. But my iOS devices are still exhibiting the same issue having no access to iCloud and password errors.

Download the Apple Intermediate Certificates

• Apple IST CA 2 - G1 Certificate

https://www.apple.com/certificateauthority/AppleISTCA2G1.cer

I found my Keychain Access was unlocked. Should it be locked for normal operation?

Th below .cer worked on my Mac. But my iOS devices are still exhibiting the same issue having no access to iCloud and password errors.

Download the Apple Intermediate Certificates

• Apple IST CA 2 - G1 Certificate

https://www.apple.com/certificateauthority/AppleISTCA2G1.cer

Add me to the list of people having this same issue. For me, it started on Apr 7, and after trying lots of solutions in Apr 8, and spending three hours on the phone with Apple, it looked like it was fixed by a reinstall of Sierra and removing/rebuilding the Keychain folder contents and the com.apple.system.preferences.plist file. (Now I am not sure why that worked if it was a certificate issue.)

It was fine until yesterday, when I got my monthly Apple ID lockout (since 2020, my AppleID started to lock me out periodically. It went from once every few months to monthly to weekly, disappeared for a long time, and then came back last Fall, locking me out once a month again. Many people complained about this problem on this forum and concluded that it's a problem with Apple's servers and had no relationship to the OS, or if someone used 2FA). And then nothing worked this time until I posted my own question and a kind person referred me to this certificate solution.

My expiration also says May, so this may be another monthly task, along with the lockout, unless they are related, and that is why all of my devices - old and new, supported and not - are locked out. Maybe they all need to re-certify and now the Sierra laptop can't on it's own because of an Apple server bug.

Maybe I'm just [un]lucky! My 8yo Macbook is running Mojave 10.14 and had the first error in April, and downloading the certificate fixed it for me. And then stopped syncing again when the certificate expired.

Ooopss!

I forgot to mention since it has allready expired (in my timezone at least) In Keychain access menu bar go to View/Show Expired Certificates.

It should appear there.