Apple Software Update service errors due to expired SSL certificate

When checking for Apple software updates today, my colleague Tim Sutton noticed that there was a problem with checking updates. When I checked for updates on my 10.8.x and 10.9.x Macs using the App Store and the command-line softwareupdate tool, I received the same error from both:

The operation couldn’t be completed. (NSURLErrorDomain error -1012.)

The reason for the error has its root in a change which Apple introduced with OS X 10.8.x, where Macs running 10.8.x and 10.9.x use an HTTPS URL to check for updates on Apple’s Software Update servers. It appears that the SSL certificate used to validate Apple’s Software Update service has expired as of Saturday, May 24th at 7:59:59 PM Eastern Daylight Time.

Since the certificate needs to be valid in order for connections to Apple’s Software Update servers to work properly, the certificate expiration is preventing the Software Update service from connecting.

When I checked for software updates on Macs running 10.7.5 and 10.6.8, they were unaffected by this issue. Macs running 10.7.x and older use an HTTP URL to connect to Apple’s Software Update servers, which means they do not use an SSL certificate to validate the connection.

Hopefully, Apple is able to get a new certificate in place soon. Once a valid certificate is in place, Apple’s Software Update service should begin working again for Macs running 10.8.x and higher.

Update: May 25th, 2014 – It appears that Apple has acted with dispatch to fix this issue. A new SSL certificate is now in place, with an expiration date of Tuesday, May 24, 2016 at 7:59:59 PM Eastern Daylight Time.

Latest version of Skype now only available for Macs running 10.9.x or higher

While assisting a user today whose workstation is running 10.8.5, I downloaded the latest version of Skype and tried to run it. To my surprise, I received the following message.

It looks like Skype 6.1.7 only supports 10.9 and higher, which is not something mentioned on the Skype support site’s system requirements page.

The new system requirements are available on the Skype download page by clicking the System Requirements link found there.

For those that need a version of Skype that works on 10.6.x – 10.8.x, it looks like Skype 6.1.5 (334) is the latest version available. It’s available from the following link:

http://www.skype.com/go/getskype-macosx-106-107-108

Hat tip to @tvsutton for finding the download link for the latest version of Skype that works on 10.6.x – 10.8.x.

Users folder being hidden with iTunes 11.2 installed and Find My Mac enabled

One side effect of the iTunes 11.2 update on Thursday, May 15th 2014 has been that some but not all Macs were seeing the /Users and /Users/Shared folders disappear.

The permissions on the /Users folder were also changed to be world-writable, so that anyone could read and write to the /Users folder.

---

Update – 5-16-2014: Apple has released iTunes 11.2.1 to fix this issue. It’s available via Apple’s Software Update or from the main iTunes download site.

After installing iTunes 11.2.1, I’ve verified that I can re-enable Find My Mac and not have /Users or /Users/Shared vanish. The permissions on /Users were also still correct following the installation. To verify that the fix sticks, I rebooted several times and observed that the visibility and permissions for /Users and /Users/Shared stayed what they should be.

---

After considerable investigation by the folks in the ##osx-server IRC room, it looks like the issue has been tied to two causes:

1. iTunes 11.2 being installed

2. iCloud’s Find My Mac being enabled.

The 10.9.3 update does not seem to be the root cause, as the behavior has also been reproduced on 10.9.2 with iTunes 11.2 and Find My Mac enabled.

To fix this issue if you’re seeing it:

1. Open System Preferences

2. Open the iCloud preference pane

3. Check if Find My Mac is enabled.

4. If Find My Mac is enabled, uncheck it to disable it.

5. Run the script below

	#!/bin/bash
	# Detects if /Users is present
	# If /Users is present, the
	# chflags command will unhide it
	if [[ -d "/Users" ]]; then
	chflags nohidden "/Users"
	fi
	# Detects if /Users/Shared is present
	# If /Users/Shared is present, the
	# chflags command will unhide it
	if [[ -d "/Users/Shared" ]]; then
	chflags nohidden "/Users/Shared"
	fi
	# Runs a permissions repair to fix
	# the world-writable permission on
	# /Users
	diskutil repairPermissions "/"
	exit 0

view raw

gistfile1.txt

hosted with ❤ by GitHub

What this script does is look for the /Users and /Users/Shared directory. If found, the directories are unhidden. A permissions repair is then run using the diskutil command to fix the world-writable permission issue for the /Users directory.

Note: The permissions repair may take up to 10 minutes to run.

Once the script is run, the /Users folder should be visible again.

It is important that Find My Mac be disabled before the permissions fix is run and also that Find My Mac remain disabled. If Find My Mac is re-enabled, the /Users and /Users/Shared folder will disappear again and /Users will revert to being world-writable.

My understanding is that Apple is aware of the issue and working on it. Hopefully a fix appears quickly.

The script is also available on my GitHub repo:

https://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/unhide_users_and_fix_permissions

A payload-free package containing the script is also available there, to help automate running this script.

Converting video files to play on both Macs and PCs with Handbrake

Telestream’s recent conversion of Flip4Mac from a free app to a paid one has left many Mac admins without a free vendor-supported solution to display Windows Media files in. One particular niche that Flip4Mac has filled for me over the years has been with groups collaborating across platforms on shared presentations. Flip4Mac allowed embedded .avi and .wmv movies created on Windows to work without many issues in PowerPoint presentations that were ultimately given on a Mac.

In situations like this, if paying for the Flip4Mac plug-in isn’t an option, the best fix is going to be converting the video files from a platform-specific format to one that is supported on multiple platforms. A good candidate here is going to be the MP4 format using the H.264 video codec and fortunately, there’s free tools like Handbrake available to help with this conversion. See below the jump for how to convert a Windows Media File to MP4 format using Handbrake.

Building Simple Packages With Packages

One of the responses I got to my post on Simple Package Creator.app was this one from my colleague Per Olofsson.

I’ve used Packages for a while now, but I had no idea it could do this. Not only does it do a similar job to my tool, it’s more automated. To show how this works, I’ve made a video showing the process with Firefox 29.

The package produced at the end installs to /Applications and will have the following permissions:

Owner: root (read-write)

Group: admin (read-only)

Everyone: (read-only)

Thanks to Per for pointing this out and to Stéphane Sudre for building this handy capability into Packages.