15 ms·
Mac Store Apps Stopped Working Due to Expired Security Certificate
- _lce0 11y agoCurious about how do the user launches the app store if any app-store app cannot be launched? Isn't then the app store validated with the same method?
- ceejayoz 11y agoI suspect the App Store comes with the OS, not from the MAS. Same situation as Messages, Calendar, Safari, etc.
- mikeash 11y agoIndeed. If you got the App Store from the App Store, that would be a bit of a catch-22. The expired certificate was part of the receipt that gets generated for an App Store app to indicate that you have the right to use that app on your computer. Stuff that ships with the system doesn't need this and so doesn't have receipts.
- swiley 11y agogit, tar, make, and gcc (or clang/llvm) Probably still work.
- M4v3R 11y agoThese are not Mac App Store apps.
- kazazes 11y agoHe's most likely saying that while the MAS is broken, you can still download something via git and build it yourself.
- kayamon 11y agoI'll just go compile my own PhotoShop, hang on.
- kuschku 11y agoI think the parent comment was suggesting to git-clone or wget and untar source, make and install. So, instead of buying overpriced software from the mac store, just building it from source.
- CJefferson 11y agoActually no they didn't if you had recently upgraded xcode, because you have to agree to the xcode terms and conditions to use them.
- swiley 11y agoThat's hilarious.
- arm 11y agoBased on the update to the article that dak1 mentioned¹, I’d say that’s actually incorrect: “Apple issued a new, stronger (SHA-2) Mac App Store certificate in September, before the older (SHA-1) one expired, as planned. The new Mac App Store certificate was using the current, strong SHA-2 algorithm. However, some apps were running receipt validation code using very old versions of OpenSSL that don’t support SHA-2. OpenSSL started supporting SHA-2 in 2005, which is why Apple didn’t foresee this issue.” Since I seriously doubt any of Apple apps would be using the older SHA-1 certificate, this probably only affected third-party apps. ―――――― ¹ — https://news.ycombinator.com/item?id=10561748 https://news.ycombinator.com/item?id=10561748
- valine 11y agoI guess it a good thing hardly anyone uses the Mac App Store.
- deleted 11y ago[deleted]
- zuck9 11y agoAlmost all OS X apps made by Apple are available exclusively through MAS. MAS distributes lots of very popular apps like Xcode, Keynote, Pages, Numbers. Imagine a non-techy user trying to open Pages and getting that error message.
- kyrra 11y agoXcode you can download from the developer portal for Apple. It's definitely not exclusive to the AppStore.
- zuck9 11y agoRight, edited parent.
- mikeash 11y agoOr imagine any user, techie or not, trying to open Keynote to give a presentation and getting that error message. It's completely ridiculous and has me vowing never to buy (or get for free) anything from the Mac App Store again. Unfortunately I have little choice on iOS.
- toyg 11y agoI've seen this happen with Yoink! on my machine, I assumed it was a bad update and just kept going... after 24 hours without Yoink, I was so annoyed that I deleted it and redownloaded it, and after a couple of failures starting eventually it worked. Glad to see developers are not at fault!
- a3voices 11y agoAs anyone who's released an app knows, the real problem is Apple's excessively bureaucratic certificate and provisioning processes.
- Kristine1975 11y agoCan you work around it by right-clicking[1] on the application and selecting "open" from the context menu? In some situations that helps with applications OS X deems "insecure." [1] Yes, Macs support mice with more than a single button now ;-)
- mikeash 11y agoThis wouldn't help. The problem was not that the apps were being flagged as insecure, but rather that they were being flagged as not having the right to run it on your computer. Basically, the apps demand proof of purchase (called a "receipt" in App Store terms) before they'll run, and the proof of purchase had expired, so they refused to run. The fix involves convincing the App Store to issue you a new one that isn't expired.
- martin-adams 11y agoHaha, took me a long time to release I could plug a two-button mouse into a Mac to get the second button.
- arm 11y agoMacs have had support for mice with more than a single button since at least Mac OS 9 (released in 1999).
- TazeTSchnitzel 11y agoOS 9? Was it added so PC USB mice would work on the iMac?
- arm 11y agoFrom what I can see from this thread¹, it would seem so: “The last versions of OS 9 were pretty good about right mouse button support. Most mice should work fine.” I would test it myself on my iMac G3 (Summer 2001), but unfortunately, I already upgraded it to Mac OS X v10.4.11 Tiger, and it’s getting active use, so I can’t exactly go downgrading it at the moment. ―――――― ¹ — https://discussions.apple.com/thread/1824021 https://discussions.apple.com/thread/1824021
- nfriedly 11y agoMust be fixed already. I just launched pixelmator (the only app I've purchased through the mac app store) and it started up without a hitch.
- privacy101 11y agoNobody is perfect at creating software (and probably not perfect at creating hardware either for that matter).
- escobar 11y agoThis happened to me a number of times over the last few days. The first time it happened I shrugged and rebooted the computer. When it came back up, it asked me to authentcate with the MAS and those few apps worked. Then, later that night, the same issue happened with a different app. I actually uninstalled and reinstalled the app and that worked. Hopefully they've actually fixed this now but I was pretty confused about what could be going on. The only other time I've gotten messages like that is when I'm opening an unsigned application Apple doesn't think is good, and the Security settings say to only allow trusted software.
- eridius 11y agoThere seems to be a bug in the system where sometimes it reports an app as damaged when it's perfectly capable of downloading a new receipt (this is why a reboot works, because the bug seems to only crop up after some period of usage). When I bought a new iMac and transferred all my stuff from my old computer, I had this exact same issue, all of my MAS apps were reported as damaged. After reinstalling one, I tried rebooting, and that worked; got a password prompt for the next MAS app, and the rest just worked fine at that point. Hopefully they're aware of what's causing this bug and will fix it in an OS update. Of course, when the certificate is actually expired, and they haven't replaced it yet, then the "damaged" dialog is reasonable, because the system cannot get a valid replacement receipt. But once they replaced it, OS X should have just started working again. In fact, I'm going to go file a radar right now.
- jlarocco 11y agoI keep feeling better about dumping OSX on my iMac. If I didn't need to edit photos, I'd get rid of it on my MBP, too. Debian is faster on the same hardware, and I don't have issues like this. I still love Apple hardware, but they keep screwing up the software side of things on both OSX and iOS.
- SyneRyder 11y agoI realise people are downvoting you for snark, but you make a good point. I have an old 2007 MacBook stuck on Snow Leopard & no longer getting updates from Apple (and now a bunch of software broken by this App Store bug) - but I also have Windows 10 installed on a second partition via Boot Camp, and it runs really well. Microsoft will apparently keep supporting the machine with security updates through 2025. Installing a different OS (like Windows 10, or Debian) can be a great way to give older hardware new life & continued productive use.
- swiley 11y agoI did this years ago and haven't looked back.
- nsxwolf 11y agoKind of surprised nobody thought to look at the certificate before and predicted this would happen.
- cjensen 11y agoCraig Hockenberry noted the problems with cert caching two years ago[1]. [1] http://furbo.org/2013/10/21/mac-app-store-receipts-and-mavericks/ http://furbo.org/2013/10/21/mac-app-store-receipts-and-maver...
- makecheck 11y agoI think "grace periods" should be a lot more common in software. Not every issue is the user's problem, and not every problem requires a drastic response. For instance, they could have: - Quietly noted the issue in a file somewhere, waited 24 hours, and checked again. - If the problem was still present after 24 hours, they could have made the software discreetly submit a problem report to Apple (but still launch and work correctly). - After 48 hours, they could issue a background notification to the user indicating that a problem has been detected in the program and to “please check for updates on the App Store”; but again, continue to work correctly. Or in other words, there were only about a half dozen more reasonable things they could have done that didn't involve an Amazonian break-things-immediately type of response.
- cortesoft 11y agoBut if a program keeps running with an invalid security certificate, what is the point of having the certificate at all? If the practice is 'let the program with an invalid cert run silently for 2 days', then you aren't gaining any security at all. Malware could do everything it needs in 48 hours.
- Strilanc 11y agoFor example, you could have a parameter on the cert that caused clients to probabilistically reject it 1/10000'th of the time when in the last month of the cert's lifetime (so there are really two deadlines, the probabilistic-failure one and the total-failure one). That would give you the same warning about the coming total failure, without hindring as many users.
- jimktrains2 11y agoOr you just set a calendar reminder up ahead of time or have something like nagios set up to bug you when you get close. Why make "expiration date" not mean expiration date? If my driver's license expires and I drive, I'm breaking the law. Sure, a judge or cop could be lenient, but there is no legal requirement (or justification?) for them to do so.
- 0xCMP 11y agoOh wow, is that what that was. I had upgraded recently to 10.11 and thought that caused everything. Thankfully, it solved it self a little while after. So as someone who didn't really know what was going on: It didn't really affect me too much, most apps seemed to still work partially (1Password, etc.). Still it didn't seem annoying because I thought it was the upgrade process.
- dak1 11y agoThe story has been updated with the following: "Apple issued a new, stronger (SHA-2) Mac App Store certificate in September, before the older (SHA-1) one expired, as planned. The new Mac App Store certificate was using the current, strong SHA-2 algorithm. However, some apps were running receipt validation code using very old versions of OpenSSL that don’t support SHA-2. OpenSSL started supporting SHA-2 in 2005, which is why Apple didn’t foresee this issue."
- lambada 11y agoThis needs to be upvoted, and the title changed. Turns out it was due to developers using incredibly old security code. Rather than an expired certificate.
- whatever_dude 11y agoYup, this changes my own point of view from "Gee Apple what a blunder" to "Some developers can be really dumb".
- mikeash 11y agoApple built a lame DRM system, tossed out some half-baked sample code, and then told third parties "OK, you guys go implement this yourselves" without even so much as providing a library to help with the hard parts. Then they made a pretty substantial change without even checking to see if all of these one-off third-party implementations could deal with it.
- jacquesm 11y agoScore one for centralization I guess.
- jackjeff 11y ago> Apple quickly addressed the problem by issuing a new certificate with an expiration date of 2035 2035? >The new Mac App Store certificate was using the current, strong SHA-2 algorithm. However, some apps were running receipt validation code using very old versions of OpenSSL that don’t support SHA-2. I sure hope it's not a SHA-1 expiring in 2035...
- mdlowman 11y agoThere's no problem with that. Assume the key material isn't compromised, since you have to assume that. You imply that Apple is going to keep using the cert until 2035. I can assure you they won't.
- reaperhulk 11y agoIt's also incorrect. The 2035 number is the root certificate. The leaf signer is (as of last night): Not Before: Sep 24 19:09:31 2015 GMT Not After : Oct 23 19:09:31 2017 GMT
- profmonocle 11y ago> Assume the key material isn't compromised, since you have to assume that. The nice thing about root certs is the private key is only needed to sign intermediate certs and CRLs. This means they can be kept offline in a secure location, and only accessed once every few months or so to sign new intermediate certs or CRLs. The actual crypto typically happens in a special locked-down piece of hardware, so that the actual private key never touches the memory or disk of the computer being used. The whole process is called a "key ceremony" and follows strict procedures, with technical staff and outside auditors watching every step. As far as I know, no CA has ever had its root key compromised. It would require physically breaking into a secure facility, or factoring of public key. Considering there's much lower-hanging fruit for anyone attempting to attack PKI, I'm not too concerned with a 20 year root cert lifetime. (Like you say, they could just remove it from future versions of OSX before then!)
- mdlowman 11y agoThe company I work for is in the process of migrating off of SHA-1 certs, and the amount of due diligince that has to go into this sort of an upgrade is incredible. It involves analyzing full logs of all supported client enctypes and tracking down the full set of "flavors" of clients that only do SHA-1. At the end of the day, you're going to break people, and it's all about minimizing how many people that is. Imagine the situation with hardware devices in the field from ten or so years ago. You can't update them and their software rev only supports SHA-1. What do you do? (You break them.)
- SyneRyder 11y agoThe article makes it sound like this is now resolved, but it isn't. One of my Macs is stuck on Snow Leopard. On Lion & El Capitan, I sign in to the App Store again and it's resolved. But on Snow Leopard, it doesn't display the sign-in error like 10.7 - 10.11 do. It just complains and tells you to redownload the apps from the App Store. But I can't. Apple doesn't let you download old versions from the Mac App Store. Byword 1.5.2 is the last version that works on 10.6, the current 2.x version requires 10.8. Similarly with Tweetbot, Mémoires, Space Gremlin, etc. Unless Apple magically allows old downloads, I don't think this can be fixed without Apple patching Snow Leopard. I'm not going to hold my breath. It really seems like Apple has permanently broken my purchased apps.
- jakobegger 11y agoAre you really sure about that? I thought that the App Store lets you download the latest version of apps you purchased that are supported on your OS from the "purchased" tab.
- SyneRyder 11y agoAfraid not. When I click on the Install button in the Purchased tab for those apps it tells me "[App name] can't be installed on this computer, because a 64-bit Intel processor is required" or "[App Name] can't be installed on Macintosh HD, because Mac OS X version 10.7 or later is required." (Thank you for trying to help, though!)
- rdancer 11y agoReportedly, that only works for iOS apps, not OS X ones.
- chx 11y agoOh my. You bought DRM'd apps and now the DRM comes to bite you. Lesson learned? Boycott companies DRM'ing.
- joosters 11y agoOS X 10.7 is unsupported as of October 2014, so I doubt Apple will be doing anything special to fix it. It still sucks that there's effectively a time limit on the software on your machine though.
- tarellel 11y agoI'm sure someone probably lost their job because of this.
- draw_down 11y agoEverything about this tells you what Apple really thinks about 3rd party devs. Just shameful.
- bruinfish 11y agoJust check the _MASReceipt/receipt of some apps I downloaded from App Store. The NotAfter field of the receipt certificate is still Nov 11, 2015. Wonder how OSX still allows me to run the app... Any idead?