Fixing Mavericks's Outdated HTTPS

[otetzone]

You should tell Firefox to not use the proxy. I believe I have instructions for that in the download

Absolutely. "No proxy" bullet checked for Firefox in its Network Settings.

If you search for Squid in Activity Monitor, does anything come up?

I can see two instances of it in CPU tab of Activity Monitor after typing "squid" into the search field:

:blank:

I have rebooted once.

Did you definitely add the Squid certificate to your keychain?

:blank:

It's some other certificate that is no longer trusted. With Squid it says "This certificate has custom trust settings"

 

[Wowfunhappy]

Thanks. @otetzone. Shoot me a PM with that log please.

 

[otetzone]

If you’re sure you followed the setup instructions, please PM a copy of /Library/Squid/logs/cache.log.

I'm pretty sure I did everything according to instruction. Just have PM'ed you the cache.log file.

 

[maverick28]

True, however, it wouldn't open neither in Firefox ESR nor in Safari.


I don't know whether it would make sense to try to block incoming connections at OSX firewall for Squid at this point. Please let me know if you want me to check anything, I'll be glad to help on my side. Do I need to revert squid.conf back or it's okay to leave it as it is now?

• Do you have entries in the hosts file? Examing those if they have domains to which you lost a connection. When you run any proxy, you have to exclude these domains from proxying by typing them in the excluded hosts box at the bottom of the Proxy tab in System Preferences-->Network-->Advanced. By doing that you make your system hosts file effective because, otherwise, a proxy-server overrides them by default.
• Do you run any VPN software or the related CLI utilities to enable VPN? If yes, then disable them. Little Snitch belongs to this category too.
• Here's my configuration file in macOS Lion
  

The ''iphone-services.apple.com" is how I restored my Mac's geolocation functioning by perusing access.log.
"mzstatic.com" apparently had no effect so can be removed from squid.conf: I added it by trying to resolve a non-critical issue with some thumbnails in MAS being empty (a square with a question mark).



That's in Lion. In Mavericks I added the following domains to rectify connection failures in Facetime/iMessage:

• .configuration.apple.com
• .profiles.ess.apple.com or .ess.apple.com
• .icloud.com

I even don't remember why I added iCloud, probably, just in case. In both Lion and Mavericks, I left everything in place for Squid to act on. In Lion, I discovered that excluding everything .itunes knocks iTunes Store and Genius connectivity out of its feet, so I refrained from tampering with this domain.

Now, onto the question of why it works differently for you and for me. The probable answer is that depending on your location, the macOS connects to different server networks. E.g. if you live in Paris, it scans for the nearest servers (say, in London or Bologne) and cell network stations to make the connection, determine your location etc. It's probable that where in one place it needs 2 domains to query, it needs 5 in another place and they are different: it looks like to be able to "determine" my geolocation it needs to make a connection to the host beginning with "iphone" which was quite a revelation for me.
The only way is to try by trial and error by excluding exposed domains one by one.


NB. Neither in iTunes 11 nor iTunes 10 you still can't buy apps or download updates, I didn't try to buy music since I don't like iTunes audio quality, and you can't play previews of audio-tracks either. You can play and download podcasts and videos, though.
The previous state of things changed with the release of Catalina a year ago and Music superseding iTunes.

 

[otetzone]

Do you have entries in the hosts file?

Not much. There it is -

127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
fe80::1%lo0 localhost
127.0.0.1 mediahuman.com

..where mediahuman.com is blocked on purpose.

Do you run any VPN software or the related CLI utilities to enable VPN?

No, nothing like that

Here's what I have in my proxies settings -



And here's my squid.conf -


I really have no clue what should be changed in order to have the iTunes App Store work. I mean, I don't dig that deep to understand exactly what I should be trying to add or exclude. Wowfunhappy suggested there's something wrong with the proxy, however I can't really tell. I can just provide the required data for the ones in the know

 

[maverick28]

@otetzone Try removing .apple.com and .icloud.com. With the latter, there's no need since Lion connects to iCloud in normal mode without the necessity to go proxy, and with .apple.com (by excluding all of their domains), you defeat the purpose of Squid to bypass outdated SSL restrictions resulting in the rejected authentication with iTunes Store. It means you don't need .apple.com in squid.conf. Add only subdomains, at best.

 

[otetzone]

@maverick28 After deleting entries for .apple.com and .icloud.com iTunes started to take my credentials and display apps although they don't update when I hit Update. There's short progress line for a sec and then everything comes back as it was. Meanwhile, iMessage stopped working.

It's like iTunes got better but isn't really doing what I need it to do while having iMessage broken. Had to put .apple.com back in order for it to work and the iTunes came back to "page temporarily unavailable". It seems that you're close to getting it right.

 

[maverick28]

Ok, we are a step closer to freedom.

• Now, put the entries below in squid.conf to test against iMessage/Facetime:

.configuration.apple.com, .qtpartners.apple.com, .ess.apple.com

• To test against iTunes, add the entry below; delimit it with a comma from the preceding domains as in the line above

.upp.itunes.apple.com

I believe "upp" stands for "update product/package/point"


NB. You must restart for the changes to take effect.

 

[otetzone]

@maverick28 Okay, did just that. iMessage works, iTunes works also but only in terms of showing apps. Still wouldn't download and update the apps.

And yeah, I rebooted.

 

[otetzone]

@maverick28 Is there anything else you'd suggest to do in order to have iTunes working with the apps as it should? All four entries are included now.

Update: After restart, iMessage and Facetime fail again

 

[maverick28]

Yes, you can't download and update apps, I think we have to deal with that and no way to bypass. I read the relevant messages in Console but have no slightest clue as to how to fix that.

 

[otetzone]

@maverick28 But I thought you said earlier that your iTunes worked with the app updates or did I misunderstand you? What's the point of having iTunes just display the apps without you being able to download them anyway?

 

[maverick28]

@maverick28 Is there anything else you'd suggest to do in order to have iTunes working with the apps as it should? All four entries are included now.

Update: After restart, iMessage and Facetime fail again

That's because of a bug in Mavericks when some login items aren't started at the beginning of a user session (that is, when a user logs in); in Lion everything rock solid. To make it work Squid should start after some delay which wowfunhappy determined to be around 30 sec. I'll send you a modified LaunchAgent in PM.

As for iTunes, you either stay on the current version or you can update to iTunes 12.6 and you'll regain the ability to update apps, listen to audio-previews and the like. I wanted it to just be able to play Genius playlists and offer album art.

 

[otetzone]

@maverick28 Thank you! Can't wait!
Meanwhile, wowfunhappy.com still wouldn't open. I don't know if this info might help.
And are you telling that downloading/updating apps through iTunes isn't possible no matter what?
Meanwhile, I returned the .conf file to it's original state. So I can go again from the scratch
I have iTunes 12.6 on HS machine. I doubt the process is the same with High Sierra because they already invented SIP by then. To add to that, ITunes 12 just looks wrong on Mavericks with all its circles design, I hate it. I'd rather go back to iTunes 10 on Mavericks than to 12. I just want to have it to work the way it used to.

Update. I noticed something interesting. Without .icloud.com included in the list of the .conf file, Facetime fails while iMessage works. As soon as I add .iclould.com Facetime works just fine and iMessage seem to send messages significantly quicker. Hope this helps.

 

[Wowfunhappy]

Having seen his log file, I’m pretty sure the issues otetzone is experiencing have nothing to do with the list of excluded domains, or hosts, or anything like that, so I wouldn’t bother messing with it. Rather, the proxy is just... not working properly in general. It’s giving a weird, nondescript ssl error.

That doesn’t mean I know how to fix it, mind you...

 

[Wowfunhappy]

To make it work Squid should start after some delay which wowfunhappy determined to be around 30 sec. I'll send you a modified LaunchAgent in PM.

The attachment in the first post already contains that startup delay now.

 

[maverick28]

@otetzone

You disabled private messages so writing here to save time. Sending you a modified com.wowfunhappy.plist in the attachment. Since MacRumors doesn't allow plist attachments for some reason, I'll send a Google Drive link to the file.

com.wowfunhappy.plist

If it's zipped by GoogleDrive, unzip it first to the Downloads folder. Put it in /Library/LaunchAgents/ by executing the following command in Terminal:

sudo cp -f Library/Downloads/com.wowfunhappy.plist /Library/LaunchAgents/

and restart

 

[maverick28]

Having seen his log file, I’m pretty sure the issues otetzone is experiencing have nothing to do with the list of excluded domains, or hosts, or anything like that, so I wouldn’t bother messing with it. Rather, the proxy is just... not working properly in general. It’s giving a weird, nondescript ssl error.

That doesn’t mean I know how to fix it, mind you...

That's some Voodoo here and there. I have no troubles connecting to your site even in Safari 5, let alone newer. I don't know what exactly plagues him, but that most certainly could have his routing table involved, i.e. how it's mapped. That's pure speculation on my part since these settings are identical on every Mac. More specifically, it's quite different depending on whether the connection aborts happen in Firefox or Safari. How in the world Firefox would fail to connect if it's not using the system settings? If Safari still fails, then he could clear the cookies or trash the Cache file in the Caches folder of the home library ~/Library/Caches/com.apple.Safari. It grows to a whopping figure of hundreds of MB (400, 700) very quickly, and Safari becomes slow and unresponsive, taking up a formidable amount of disk space. @otetzone, trash this folder and (of course! Good gracious - Apple Just Works, So Simple) restart the Mac.

 

[Wowfunhappy]

You disabled private messages so writing here to save time. Sending you a modified com.wowfunhappy.plist in the attachment. Since MacRumors doesn't allow plist attachments for some reason, I'll send a Google Drive link to the file.

Again, this startup delay is already included in the download in the first post.

---

@otetzone Clarify something for me. If you completely disable the proxy in System Preferences, Firefox is able to connect to every website, and iMessage/AppStore/Maps all work fine, correct?

 

[otetzone]

@otetzone Clarify something for me. If you completely disable the proxy in System Preferences, Firefox is able to connect to every website, and iMessage/AppStore/Maps all work fine, correct?

I assume you're talking of taking a checkmark off Secure Web Protocols in Network Settigs in Proxies tab? I did.
The result is that iMessage works, Facetime fails, wowfunhappy.com still doesn't open although other websites work just fine and iTunes is useless, not even showing apps in Store. I have your original .conf file at the moment, but changed the com.wowfunhappy.plist for the one that I downloaded from GoogleDrive. I'll replace it with the original one, reboot and report in a minute

Oh, forgot to mention, also cleared Safari cache as well.

 

[Wowfunhappy]

The result is that iMessage works, Facetime fails, wowfunhappy.com still doesn't open

Okay, there is unfortunately something wrong with your computer/network that is unrelated to the proxy. I don't think I can help you further. iMessage, FaceTime, and my website† should all work on Mavericks without you doing anything.

You might try seeing if the problem still happens on a guest account or fresh user account; if it does, that would hint at where the problem lies. But, usually when I start getting really weird errors like this, I use it as an opportunity to do a full, clean OS reinstall. But, you'll have to decide what's worthwile.

(†I feel really weird that my own site became the test case, but 🤷‍♂️)

 

[otetzone]

With proxy SSL disabled iMessage worked significantly slower, Facetime faied as well as iTunes. I put everything back as it was from the beginning (although adding .icloud.com did help in terms of speed of sending messages), enabled proxy and iMessage is lightning fast now but Facetime fails and so does iTunes.

I wish I could provide you with some more stuff that could help. Just in case, I reinstalled Maverics over existing installation about a week ago. Definitely not a clean install but it usually fixes some issues sometimes. I'll remove the files and install them on the new account and let you know

 

[otetzone]

It's late here now, I'm fixin' to go to bed. I'll try to make a fresh user account tomorrow and check everything on it and will report here. If it won't work I'll go as far as making a fresh install. I want this thing to work. I really need managing apps with iTunes. Just in case I make a fresh install, do I have to immediately downgrade to iTunes 10.6, does it make any sense?

reinstalled again on a current user, iMessage works, Facetime works, iTunes Store fails. But this is exactly how it had been before I installed Squid. I'm so confused. Will continue experiments tomorrow. Thank you guys for your help! Whatever info you need I'd be glad to provide in order to fix this issue.

 

[maverick28]

It's late here now, I'm fixin' to go to bed. I'll try to make a fresh user account tomorrow and check everything on it and will report here. If it won't work I'll go as far as making a fresh install. I want this thing to work. I really need managing apps with iTunes. Just in case I make a fresh install, do I have to immediately downgrade to iTunes 10.6, does it make any sense?

reinstalled again on a current user, iMessage works, Facetime works, iTunes Store fails. But this is exactly how it had been before I installed Squid. I'm so confused. Will continue experiments tomorrow. Thank you guys for your help! Whatever info you need I'd be glad to provide in order to fix this issue.

I think you should've stopped at the modified instance of the conf file by including all the domains that I suggested in post #58. If it worked and you had all these apps and services running then it's the best you can get with a macOS as old as Mavericks.

 

[Wowfunhappy]

I think you should've stopped at the modified instance of the conf file by including all the domains that I suggested in post #58. If it worked and you had all these apps and services running then it's the best you can get with a macOS as old as Mavericks.

...I don't agree. Something is fundamentally broken on their machine, and they will likely discover more problems as they go on. All of the built-in Apple services should work on Mavericks without a proxy (except iTunes, I guess—as I've said I don't have iTunes).


Edit:

reinstalled again on a current user, iMessage works, Facetime works, iTunes Store fails. But this is exactly how it had been before I installed Squid. I'm so confused. Will continue experiments tomorrow. Thank you guys for your help! Whatever info you need I'd be glad to provide in order to fix this issue.

Wait, now I'm confused! So Facetime originally worked before you installed Squid, but not after you installed Squid but disabled the proxy? That doesn't make any sense!

I want to make clear that Squid is not making some type of deep change to your system. You can completely undo everything by following the installation instructions in reverse (so, delete the files you copied, remove the certificate from keychain access, etc).