Updating SSL root certs on old Mac (running Lion) My father-in-law reported an "Invalid SSL certificate" suddenly started appearing on his online banking website.

After verifying it's not a website issue (it loads correctly on other computers), I understood that the root certificate of the website certificate is not being trusted probably because too new and the Mac is not being updated anymore.


Is my understanding correct?
If yes, is there a safe way to download new root certificates that are being added to recent Macs?
Yes, if the certificate is being accepted by other, newer machines, the issue it does seem likely that your father's machine isn't receiving updates to its root certificate trust store.  I wasn't able to  verify that Lion isn't receiving those but I think it's a fair guess.
Well, that's a harder question to answer.  If you look here and here, it does seem like it's possible to do, but you'd need to find the keychain files from a newer OS and pull them into Lion.  It's really just a guess as to whether the steps in that answer would work for you since it's 10.8.  I actually would advise figuring out which certificate shows up as expired on your machine (or which root certificate is missing/untrusted), and downloading that specific certificate and appropriately trusting it, first.  But if you want to, you could also backup your system and give that second answer a shot.  Hopefully you have access to a more recent macOS installer you can extract files from.