<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi David,<div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 24, 2020, at 4:00 PM, David Reitter <<a href="mailto:david.reitter@gmail.com" class="">david.reitter@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">You forget that there are some 100,000 copies of Aquamacs sitting on people's computers. You can't remotely update which certificates are trusted.</span></div></blockquote><blockquote type="cite" class=""><div class=""><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class=""></div><div style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">The simpler solution (going forward) is to change the update URL going forward to be something like<span class="Apple-converted-space"> </span><a href="http://update.aquamacs.org/" class="">update.aquamacs.org</a>, and make the update check via HTTP. </div></div></blockquote><br class=""></div><div>FWIW, this is a little confusing because I’m not sure why it would be any easier to remotely change the URL being checked for update than it would be to remotely update the certificate being trusted. If the update mechanism isn’t working, _any_ client-side change to fix it would seem to need a manual download to get started.</div></div><div><br class=""></div><div>(But, having said that, I do agree that the simplest short-term thing to do is almost surely to change the website so that the (current) update URL is loaded via HTTP..)</div><div><br class=""></div><div>(But, having said _that_, I do also recognize that many people would prefer to see it be HTTPS in the end notwithstanding the code-signing, so maybe sometime there'll be motivation to wire the whole thing into macOS certificate validation so it’ll all “just work” going forward..)</div><div><br class=""></div><div>Cheers, -John</div><div><br class=""></div></body></html>