• Home/
  • Update Client SSL Certificate Workaround

Update Client SSL Certificate Workaround

This article applies to Dyn Updater Client version 5 (v5) for Windows, macOS, and Ubuntu Linux.

Important Update: DigiCert Root Certificate Changes

Per DigiCert's notice: Starting April 15, 2026, Google and Mozilla products will no longer trust TLS certificates issued from the impacted G1 roots. Websites and other services using those certificates may experience security warnings or failures.

  • If you use TLS (SSL) certificates from DigiCert issued with the old G1 (SHA-1) root, you must reissue your certificates with the G2 (SHA-256) root and install the new versions.
  • This also affects built-in certificate bundles in desktop applications such as Dyn Updater.

Planned Update: Dyn intends to replace the impacted certificate with a new G2 root-signed certificate in our services on or after April 1, 2026, ahead of the enforcement deadline. Please ensure your systems are updated accordingly.

Why is this needed?

Some security certificates used by Dyn update clients are expiring or being removed from industry trust stores. This can break update functionality for the Dyn Updater on Windows, macOS, and Linux. The easiest way to resolve these issues is to update the Updater's internal list of trusted SSL certificates by replacing cacerts.txt with a current public CA bundle.

Backup and Replace Instructions

Always back up your existing file first! If anything goes wrong, you can restore it.

Quick links: Windows | macOS | Linux

Windows

  1. Open File Explorer and navigate to C:\Program Files (x86)\Dyn\Updater\
  2. Right-click cacerts.txt and select Copy. Right-click and Paste in the same folder.
  3. Rename the copy to cacerts.txt.bak
  4. Download cacert.pem from curl.se
  5. After downloading, rename cacert.pem to cacerts.txt
  6. Copy the new cacerts.txt into C:\Program Files (x86)\Dyn\Updater\ Approve replacing the file and Administrator prompts if necessary.
  7. Restart Dyn Updater, or reboot your computer.

Optional: PowerShell instructions

You can also perform the above steps in a PowerShell window (run as Administrator):

cd 'C:\Program Files (x86)\Dyn\Updater'
Copy-Item cacerts.txt cacerts.txt.bak
Invoke-WebRequest -Uri https://curl.se/ca/cacert.pem -OutFile cacerts.txt

macOS

  1. Open Terminal to run the following commands (you may need to adjust the path if your install is elsewhere):
  2. sudo cp "/Applications/Dyn Updater.app/Contents/MacOS/cacerts.txt" "/Applications/Dyn Updater.app/Contents/MacOS/cacerts.txt.bak"
  3. sudo curl -o "/Applications/Dyn Updater.app/Contents/MacOS/cacerts.txt" https://curl.se/ca/cacert.pem
  4. Or use Finder to copy and rename the file in the app's Resources directory, if preferred.
  5. Restart Dyn Updater, or reboot.

Linux (Ubuntu)

  1. Open a Terminal to run the following commands (you may need to adjust the path if your install is elsewhere):
  2. sudo cp /usr/lib/DynUpdater-5.5.0/cacerts.txt /usr/lib/DynUpdater-5.5.0/cacerts.txt.bak
  3. sudo wget -O /usr/lib/DynUpdater-5.5.0/cacerts.txt https://curl.se/ca/cacert.pem
  4. Restart Dyn Updater, or reboot.

Troubleshooting and Rollback

If you encounter issues after replacing the file, revert to your backup: - Delete the new cacerts.txt, and rename cacerts.txt.bak back to cacerts.txt.

Need more help?

If you continue to have trouble, please contact Dyn support with details about your operating system and any error messages you receive.