How to delete/remove DigiNotar in Mac OS X 10.5.8's Safari?

Question

Level 1

121 points

How to delete/remove DigiNotar in Mac OS X 10.5.8's Safari?

Hello.

I noticed Apple never released an update to delete/remove DigiNotar in Mac OS X 10.5.8 since I have all updates. I was able to tell Keychain to untrust it from http://fairerplatform.com/2011/09/how-to-disable-diginotar-ssl-certificate/artic le, but it won't let me delete it. Mac OS X just beeps at me when I hit delete key on this Intel MacBook Pro (from October 2008). I tried dragging it to the trash can, but that didn't do anything. Am I missing something? I did unlock this Keychain screen and was able to untrust.

Thank you in advance. 🙂

MacBook Pro, Mac OS X (10.5.8), 2.4 Ghz

Posted on Sep 19, 2011 2:47 AM

Reply

Answer 1

andyBall_uk

Level 7

20,516 points

Sep 19, 2011 5:01 AM in response to antdude

Hi 🙂

there's a thorough-looking artcile at http://ps-enable.com/articles/diginotar-revoke-trust including a package to automate the process, and manual instructions, both of which are apparently Leopard-friendly.

Reply

Answer 2

Sep 19, 2011 5:10 AM in response to antdude

I was also not able to delete the DigiNotar root certificate in Leopard.

I just opened the "DigiNotar Root CA" in Keychain, expanded the "Trust" section and selected "Never trust" in the dropdown box.

This will mark the certificate as not trusted for all users and should do the same job as deleting it.

Reply

Answer 3

antdude Author

Level 1

121 points

Sep 19, 2011 7:01 AM in response to probe_droid

probe_droid wrote:

I was also not able to delete the DigiNotar root certificate in Leopard.

I just opened the "DigiNotar Root CA" in Keychain, expanded the "Trust" section and selected "Never trust" in the dropdown box.

This will mark the certificate as not trusted for all users and should do the same job as deleting it.

Yeah, that is what I did. According to the original article link, it is not secured enough?

Reply

Answer 4

antdude Author

Level 1

121 points

Sep 19, 2011 7:02 AM in response to andyBall_uk

andyBall_uk wrote:

Hi 🙂

there's a thorough-looking artcile at http://ps-enable.com/articles/diginotar-revoke-trust including a package to automate the process, and manual instructions, both of which are apparently Leopard-friendly.

Interesting. Is that safe to use a third party's package? Can I undo it if needed?

Reply

Answer 5

Sep 19, 2011 7:14 AM in response to antdude

Yes, you are right.

After some more reading in this article, there is a link towards the bottom of the article (the same as andyBall_uk posted above) describing how to fully protect your system. But I have not been able to load the references page yet, but will try on my Leopard system later.

I would not run any packages or installer from a non trusted source.

Message was edited by: probe_droid

Reply

Answer 6

antdude Author

Level 1

121 points

Sep 19, 2011 7:14 AM in response to probe_droid

probe_droid wrote:

Yes, you are right.

After some more reading in this article, there is a link towards the bottom of the article describing how to fully protect your system. But I have not been able to load the references page yet, but will try on my Leopard system later.

Thanks. 🙂

Reply

Answer 7

andyBall_uk

Level 7

20,516 points

Sep 19, 2011 7:30 AM in response to antdude

There's no undo included - a brief look says the package does only what it claims to, and appears safe.

If in doubt - there's manual instructions on the page, which may work on Leopard too.

Specifically the 'can't delete' problem you asked about seems similar on Snow here & yet choosing the items via search does enable the Edit-Delete menu command.

Reply

Answer 8

antdude Author

Level 1

121 points

Sep 19, 2011 7:43 AM in response to andyBall_uk

andyBall_uk wrote:

Specifically the 'can't delete' problem you asked about seems similar on Snow here & yet choosing the items via search does enable the Edit-Delete menu command.

Perfect. Search to find two hits and then deleting them (right click and then delete option for me) worked! Weird design!

Even more weird, http://fairerplatform.com/2011/09/how-to-disable-diginotar-ssl-certificate/artic le is gone! 😟 I wanted to read its instructions on how to test it.

Reply

Answer 9

Sep 19, 2011 9:56 AM in response to antdude

This one works: http://fairerplatform.com/2011/09/how-to-disable-diginotar-ssl-certificate/

Reply

Answer 10

antdude Author

Level 1

121 points

Sep 19, 2011 10:44 AM in response to probe_droid

probe_droid wrote:

This one works: http://fairerplatform.com/2011/09/how-to-disable-diginotar-ssl-certificate/

Thanks! "... Then go to diginotar.com — if you get the warning, “Safari can’t verify…” all is well." I did get any warnings. Did you?

Reply

Answer 11

Sep 19, 2011 2:00 PM in response to antdude

Nope, had followed all the steps as described (removing the sytem root certificate, importing the certificated downloaded and marking them as not trusted).

But I suppose that the diginotar.com site does not use HTTPS and hence the certificate does not get pulled.

Reply

Answer 12

antdude Author

Level 1

121 points

Sep 19, 2011 2:27 PM in response to probe_droid

probe_droid wrote:

Nope, had followed all the steps as described (removing the sytem root certificate, importing the certificated downloaded and marking them as not trusted).

But I suppose that the diginotar.com site does not use HTTPS and hence the certificate does not get pulled.

Yeah, I forced a https connection, but it reverted back to insecured connection.

Reply