MacOS – Why when I increase SSL certificate security on the mac am I unable to use the app store (preflight error)

keychainmacosSecurityssl

Given the recent OSX issues with certificates and SSL, I want to increase the security of the certificate validation in general.

I came across a setting in the keychain that has a selection between best attempt and require if certificate indicates. The selection of always validate is greyed out.

enter image description here

When I do this, I get an error when using the app store "Unable to verify the preflight file". reverting to "best effort" seems to fix the issue.

How can I increase the security of my SSL / PKI certificate validation without breaking functionality of other apps?

Best Answer

This is a known bug in the App Store. Apple needs to fix it.

The only problem with forcing a check of revoked certificates is that Apple has a flaw in how it validates Mac App Store updates. With the option selected as shown in the figure below, you may be unable to perform updates through the App Store program. To fix that, launch Keychain Access, change the preferences to Best Attempt, update your apps, and then reset to the stricter setting. This is something Apple should clearly fix, since all the components of this situation are under its control.

http://www.macworld.com/article/1162472/keep_your_mac_safe_from_web_security_flaws.html

Related Question