Redownload Archived macOS Installers to Address Expired Certificates

@taryfast – I downloaded the installers using the links in the originally published TidBITS article:

The article lists the Apple support documents for installing Yosemite, El Capitan, Sierra, High Sierra, Mojave and Catalina. Each of the support documents has links to the installers, and according to the senior AppleCare advisor those links are the official way to obtain the installers.

1 Like

No dice here today. Just downloaded Sierra’s installer again, tried to make a bootable with the same error as yesterday.

Has anyone gotten Sierra to work? How?

Thank you,

I may have found a workaround, but still need to test it before sending folks on a wild goose chase. More when I get time.

Added: Doesn’t work.

After downloading the macOS Mojave installer from that link, then opening the file, I still get the error message:

This copy of the Install macOS Mojave application is damaged, and can‘t be used to install macOS.

Any other ideas?

There appears to be a bug in Apple’s latest release of the Sierra installer (with new certificate). I’ve been unable to create a bootable installer from it and have seen multiple reports across the internet of the same. Hopefully they will fix it soon. If anyone has discovered a workaround, please let me know. Thanks!

I got one report of a Slack #MacAdmins #Sierra subscriber that he got it to work yesterday, so started a discussion with him to see if he has a workaround.

Using Terminal I get the following error right after it starts:

/Volumes/MyVolume is not a valid volume mount point.

I can see in Finder and Disk Utility that it is mounted there and can cd to it in Terminal, so not sure why createinstallmedia isn’t able to.

Using various versions of DiskMakerX, Install Creator and another app developed by a colleague, in OS Sierra, Mojave and Catalina, I get a variety of error messages, but none of them are able to accomplish the first step, which is erasing the target volume after entering my admin password.

-Al-

Where in all that crap is the expiraion date?

I got them all to download, except High Sierra. On the app store page for HS I got an Open button, even though I had unmounted my archive volume that contained the HS installer. So I used the macOS High Sierra Patcher tool as you directed, getting the installer download instruction from the Tools menu. Great app. High Sierra was them downloaded to my specified location. So now I have updated apps for all the macOS X installers in your list. However, this was the only one, besides Mojave, that downloaded the app. The other links downloaded dmg copies, which do not contain the usual installer app. So I retained the apps for Mojave, El Capitan and Yosemite.

Interestingly, the folder “HighSierraDownload” was also downloaded. It was empty when I opened it so I threw it away. Surprisingly, the High Sierra installer also disappeared. So I downloaded it again before discovering that the first installer was in the trash with the HighSierraDownload folder. They are somehow linked, I guess because the installer components were originally in the folder. I tried trashing the HighSierraDownload folder for the second High Sierra download and it was not removed this time. Odd and odder. This may seem trivial; I mention it in case someone else runs into the same problem.

By the way, I’ve gotten the out-of-date certificate message before with old Apple app installers and was able to run the installers anyway, ignoring the message. I haven’t tried it with on OS installer, though, but it might be worth a try.

It’s not crap, they’re encryption key signatures. They’re not meant to be read, they’re meant to be compared to other fingerprints.

The command does not show when they the signing certificates expire, only whether they’re currently valid or expired. If used on an unsigned package, the output is only “Status: no signature.” When a certificate has expired, the output still includes the fingerprints but it says “Status: signed by a certificate that has since expired.”

That just indicates that you still have an older copy of the installer squirreled away somewhere on your boot drive. The App Store is very good at knowing this, so you might want to spend a bit of time trying to locate and trash it. That may well be why the one you downloaded was then moved to trash.

1 Like

I tried to download Mojave several times but each time I only got a 22 MB stub installer. How do I get the complete 6 GB file?

I believe there has been server maintenance ongoing all weekend and several others have complained with various symptoms. I would try again tomorrow and see how it goes.

An IT colleague of mine just posted this to Slack #MacAdmins #Sierra:

FYI: I opened a ticket with ATS — they confirmed you can’t make a bootable Sierra installer with the “certificate-fixed” version and wanted me to give them information stating why it was important that somebody look at fixing this. I recommend you pile on with that if it’s an issue for you. (I’m able to make the old Sierra installer work by setting the clock back for now, but I’d honestly be surprised if Apple fixed the 10.12 installer at this point…)

I’m still attempting to find workaround, but my previous one failed.

I just downloaded them all. All three of the direct downloads from the Apple pages, Yosemite through Sierra, don’t have full names, just “InstallOS.dmg” or “InstallMacOS.dmg”. The installers inside have the same names as the images. The only way to tell which version is which is to run the installer, and either get an error message that 10.10 or whatever can’t be installed on this machine, or if the version can be installed, look through the files list for clues. This doesn’t give me a lot of confidence that I’d ever want to run them. If they can’t even be bothered to name their installers properly, what else might be mangled?

With Catalina command line softwareupdate, I haven’t been successful at fetching anything earlier than 10.13.6, though asking for 10.11.5 did give me a chimera progress percentage before telling me it couldn’t find it once the percentage got to or near 100%. That percentage went much faster than for the real downloads, so it was likely just another bug.

Here is a method that doesn’t involve changing the system clock on the target computer, and works reliably to create a bootable SIERRA installer. Use createinstallmedia on the OLD installer (the one with the expired certificate) to create your bootable USB drive. Once created, open the USB drive and move the installer app “Install macOS Sierra” from the USB drive into the trash and empty trash. Although it will seem like the USB drive is now blank, it isn’t. There are a bunch of “hidden” files that will boot the USB drive. Next, use Apple’s current installer to put the updated version of “Install macOS Sierra” (with the valid certificate but apparently a non-working createinstallmedia) back into your Applications folder of your computer. Finally, copy that app (“Install macOS Sierra”) from your Applications folder onto that USB drive. Believe it or not, this WORKS. It’s actually the only solution I’ve seen anywhere since this mess started, that works. This is only necessary for the Sierra installer. All of the other installers with updated certificates work properly with the createinstallmedia command. To verify the solution, I booted a MacBook with the USB drive prepared as described above, used Disk Utility on the USB drive to reformat the laptop’s internal drive, installed macOS Sierra from the USB drive, then booted the MacBook with the USB drive removed, and ran the App Store system updates to verify that everything is working as expected.

As an aside, if you use Apple’s current installer (with the valid certificate but non-working createinstallmedia) to create a NetInstall .nbi folder, that works, too. But most people don’t run a NetInstall server.

As another aside, I did try moving ONLY the createinstallmedia executable from the old installer to the new installer app (by exposing the innards of the installer app using a right click and selecting “Show Package Contents”) but that did not work. You still get the same error message about a bad volume mount point.

3 Likes

Over on the MacAdmins Slack, there have been a few comments about encouraging people to clear their caching servers, which might have old versions of updates or installers stored. Most people here probably aren’t running into this, but if you have Content Caching enabled in System Preferences > Sharing > Content Caching, you might want to reset it or disable it temporarily.

I did exactly that, but just haven’t had the time to test it, so thanks for confirming.

Just be certain that the name of the new Install macOS Sierra matches exactly with what the old installer name was as there are some embedded links to that name in the hidden files.

I tried again two days later and still cannot get the full 6GB Mojave installer. This is on a Mac Mini running El Capitan.

Hi
I downloaded El Capitan from the link above and launched it to have Install OS X El Capitan.app in /Applications.

One thing i noticed is, it gives me different hash of InstallESD.dmg each time i redo the procedure. The timestamp is different too.

E.g.
Step 1. making sure there is no existing Install OS X El Capitan.app in /Applications, launch the InstallMacOSX.pkg then take note of the InstallESD.dmg hash.
Step 2. Doing the Step 1 again.

Result: Im getting 2 different hash result of InstallESD.dmg

Is this normal?

For softwareupdate command line downloads, a friend ran a script to download every possible version number from 10.7 up and confirmed that only these are available, and they’re identical to the app store versions:

10.13.6
10.14.6
10.15.1

So there’s no easy going back a minor version or two in case an update breaks an app.

1 Like