>You cannot directly download or install High Sierra (the latest supported OS) for reasons I don't remember.

This one’s a doozy because i hit it last month.

The updates are over https. The default certificates are 10year expiry.

I had an elderly relative (who disabled updates because they were scared of the computer changing) really upset everything was broken. Gmail app gave obscure can’t connect messages, almost all websites failed to load. When i went there of course the os wouldn’t update as well. We use https for everything now.

The keychain system is so hidden from users it was hard to even get to for myself. Took a usb key of a set of certificate updates. Harder than you think because when you look in keychain you’re not sure of which certificate is used for which and it’s a pain to find what you need. In the end a transfer from a healthy mac worked enough to get a manually downloaded os update running and from there it was fine.

What a doozy though! If you know of people with old macs that stopped working at the start of this year this is why