Problems while updating iPad software

[kare2k]

I have been having problems updating my iPad software recently. It freezes about 1/3 of the way thru the process. By using the Apple Community I have found some troubleshooting steps, and just yesterday the solution was to disable my Norton protection!!! Is there some way for Norton to allow access to the Apple update server without me disabling my protection? Thank you.

[bjm]

@kare2k

I have been having problems updating my iPad software recently. It freezes about 1/3 of the way thru the process. By using the Apple Community I have found some troubleshooting steps, and just yesterday the solution was to disable my Norton protection!!! Is there some way for Norton to allow access to the Apple update server without me disabling my protection?

Hello @kare2k

No, there is no way to whitelist specific URLs or apps inside the Norton iOS/iPadOS app because Apple’s strict sandboxing rules prevent mobile security apps from having that level of network configuration control. On an iPad, Norton 360 filters internet traffic by routing it through a localized, basic VPN protocol or configuration proxy to run features like Safe Web and Wi-Fi Security. When Apple attempts to verify an iPadOS update, this proxy routing can trigger a false positive or cause a timeout, causing the update to freeze or error out.

Instead of disabling your entire protection suite every time, you can bypass the block using two much cleaner workarounds:

Method 1: Turn off “Safe Web” temporarily (Recommended)
You do not need to uninstall or turn off all of Norton; you usually only need to toggle the specific feature causing the traffic filtering conflict.

1. Open the Norton 360 app on your iPad.
2. Tap on the Internet Security card.
3. Locate Safe Web and move the slider to Off.
4. Run your iPadOS update via Settings > General > Software Update.
5. Once the update completes, return to Norton and turn Safe Web back on.

Method 2: Update using a computer
If you update your iPad using a desktop computer, your iPad’s internal Norton configurations are completely bypassed because the computer handles the download and verification.

• On a Mac (macOS Catalina or later): Connect your iPad via cable, open Finder, click your iPad in the sidebar, and select Check for Update.
• On a Windows PC or older Mac: Connect your iPad, open iTunes, click the device icon, and select Check for Update.

Method 1: Disable “Safe Web” only

On your iPad, open the Norton app and navigate to Safe Web (sometimes listed under Security or Privacy features) and toggle it off. Then start the iPadOS update. Once complete, turn it back on.

Why this works: Safe Web is the component that uses the local proxy/VPN-style filtering to scan web traffic. Apple’s update process needs a clean, direct TLS connection to swcdn.apple.com and mesu.apple.com for firmware verification. The proxy interception breaks certificate pinning, which is why the install stalls around a third of the way in — that’s typically where signature verification happens.

Other Norton toggles worth checking if Safe Web alone doesn’t fix it:

• Wi-Fi Security / Automatic Wi-Fi Protection — also routes through the same filter
• Ad Block / AntiTrack — can interfere with CDN downloads

You generally do not need to disable Identity Safe, cloud backup, or iCloud Keychain integration, since those don’t touch network traffic.

Method 2: Update via computer

This is the most reliable option and worth doing regardless:

1. Connect iPad via USB-C cable to a Mac (Finder → device sidebar) or PC (Apple Devices app / iTunes).
2. Select Check for Update, not Restore.
3. Let the computer download and verify the IPSW file.

Advantages beyond bypassing Norton: the computer caches the signed firmware, so if the install fails you can retry instantly without re-downloading ~1–6 GB over Wi-Fi. It also survives low battery better since the Mac/PC supplies power.

Other causes of freezing at ~1/3

Since you mentioned you’d already tried Apple Community troubleshooting, worth ruling these out too:

Cause	Check
Insufficient storage	Settings → General → iPad Storage (need ~8–10 GB free; “Offload Unused Apps” helps)
Weak/unstable Wi-Fi	Try a different network, or tether briefly via phone hotspot
Stale partial download	Settings → General → iPad Storage → find the iOS/iPadOS update entry → Delete Update, then re-download
Overheating	Remove case, update on a hard surface away from sunlight

The “delete the downloaded update and retry” step fixes a surprising number of stuck-at-one-third cases, because a corrupted partial download will fail at the exact same spot every time — which matches your symptom pattern.

Longer-term

If this recurs with every iPadOS release, consider whether Norton is earning its keep on the iPad specifically. On iOS/iPadOS the OS sandbox already provides strong app isolation, and Norton’s real value there (Safe Web, Wi-Fi scanning) overlaps heavily with Safari’s built-in fraud warning and iCloud Private Relay. Many people run Norton only on Mac/Windows where it has kernel-level access and actually does something meaningful, leaving iPads and iPhones on Apple’s native protections.

The Technical Root Cause: Why Norton Breaks iPadOS Updates

The core issue is TLS Certificate Pinning. Apple’s update servers (swcdn.apple.com, mesu.apple.com) use certificate pinning to prevent man-in-the-middle attacks. When Norton’s Safe Web feature activates, it installs a local VPN tunnel and injects its own root certificate into the device’s trust store to intercept and inspect encrypted traffic.

This creates a conflict:

1. Apple’s update client detects the connection is no longer going directly to Apple’s servers but through Norton’s proxy.
2. The TLS handshake fails because the certificate doesn’t match the pinned certificate Apple expects.
3. The update client hangs during the signature verification phase (around 1/3 progress) rather than failing cleanly, because it’s waiting for a response that never arrives.

This is why simply reducing Wi-Fi strength or having minor network latency doesn’t cause this specific stall — only direct certificate interference triggers it.

Method 1: Disabling “Safe Web” — Step-by-Step

Not all Norton apps display “Safe Web” in the same place. Here’s how to find it:

Norton 360 for Mobile:

1. Open the Norton app.
2. Tap Security or Privacy in the bottom navigation.
3. Look for Safe Web or Web Protection.
4. Toggle it Off.
5. Immediately initiate the iPadOS update (Settings → General → Software Update).
6. After the update completes and the iPad restarts, return to Norton and toggle Safe Web On.

Important timing: Do not toggle Safe Web back on before the installation finishes. The update verification process continues even after the download completes, during the “Verifying Update” stage. Toggle it off before starting and only turn it back on after the “Welcome” screen appears post-restart.

If Safe Web alone doesn’t work: Try also disabling Automatic Wi-Fi Protection (if available). This feature automatically connects to Norton’s VPN when on untrusted networks and can cause the same certificate conflict.

Method 2: Updating via Computer — Detailed Steps

This method is more reliable and is actually Apple’s recommended approach for problematic OTA updates.

On Mac (macOS Catalina or later):

1. Connect your iPad via USB-C or Lightning cable.
2. Open Finder.
3. Select your iPad from the sidebar.
4. Click Check for Update.
5. If an update is available, click Download and Update.
6. You may need to enter your iPad passcode and trust the computer.

On Windows PC:

1. Install the latest version of Apple Devices app (Windows 10/11) or iTunes (older versions).
2. Connect your iPad.
3. Click the iPad icon or select your device.
4. Click Check for Update.
5. Download and update as prompted.

Key advantages:

• Cached firmware: The computer downloads the IPSW file once. If the update fails partway, you can retry immediately without re-downloading 1–6 GB.
• Power stability: The computer supplies power through the cable, eliminating battery-related interruptions.
• Bypasses all iPad network filters: The update traffic flows through the computer’s network connection, not the iPad’s. Norton on the iPad has zero influence on this process.

If the computer update also fails: You can manually download the IPSW file from Apple’s server and perform a manual update. This gives you full control over the firmware file and bypasses any automatic download corruption issues.

Alternative: Delete the Stuck Update

Before trying either method, if you’ve already partially downloaded the update:

1. Go to Settings → General → iPad Storage.
2. Scroll down and look for an entry like “iPadOS 18.x” or “Software Update.”
3. Tap it and select Delete Update.
4. Restart the iPad.
5. Try the OTA update again (with Safe Web disabled) or use a computer method.

This clears any corrupted partial files that could be causing the freeze.

Why This Is an iPad-Specific Issue

On Mac and Windows, Norton has kernel-level access and can configure firewall rules that explicitly allow or block specific domains. On iOS/iPadOS, Apple’s sandbox architecture prevents any app from accessing network traffic from other apps directly. Norton works around this by using a VPN configuration profile that routes all device traffic through its proxy — which is powerful enough to scan traffic but fragile enough to break certificate pinning.

This architectural limitation is why whitelisting specific URLs is impossible on iPad, but possible on desktop Norton versions.

When to Consider Removing Norton from iPad Entirely

Consider whether Norton provides meaningful value on your iPad:

App sandboxing	No access	Built into iOS/iPadOS kernel
Web protection	Safe Web (VPN-based)	Safari Fraudulent Website Warning + iCloud Private Relay
Wi-Fi security	Wi-Fi scanning	Limited built-in; no scanning
Malware protection	No (Apple blocks app-level scanning)	No (same reason)
Identity protection	Identity Safe	iCloud Keychain with End-to-End Encryption

For most users, Safari’s built-in protections combined with iCloud Private Relay provide comparable protection on iPad, making Norton redundant on this platform.

Norton does not have a dedicated public support document specifically titled “How to let Apple System Updates pass through Norton on iPadOS,” because the underlying limitation is structural to iOS/iPadOS. Apple’s operating system design does not grant third-party security or VPN apps the granular permission to permanently whitelist individual system domains or update servers (like Apple’s OTA update servers) inside an app interface.

When you activate features like Safe Web or Norton Secure VPN on an iPad, it installs a system-level configuration profile that funnels web requests through their filtering mechanism. Because you cannot manually punch a hole or add an exception URL inside the iOS version of Norton 360, toggling Safe Web or disconnecting the Norton VPN profile temporarily is the only functional app-level workaround provided when an Apple system update hangs.

When you turn on Safe Web (or Web Protection) inside the Norton app, it cannot just “look” at your internet traffic from the outside due to Apple’s strict privacy rules. To get around this, Norton installs a local VPN or proxy configuration directly into your iPad’s system settings.

Here is exactly how that setup creates the issue you are experiencing:

• The Local Proxy Loop: When Safe Web is active, all inbound and outbound internet traffic on your iPad is forced to route through this local Norton proxy loop so it can scan web addresses for malicious links.
• The Apple Security Conflict: When your iPad tries to download a software update, it has to establish a highly secure, direct, and uninterrupted handshake with Apple’s official update verification servers.
• The False Positive/Timeout: Because Apple’s security protocols detect that a third-party proxy (Norton) is intercepting and filtering the connection, it treats it as a security risk or simply times out. This causes the update process to completely freeze partway through.

By toggling Safe Web to “Off”, you temporarily dismantle that local proxy loop. Your iPad is then allowed to make a direct, unfiltered connection to Apple’s update servers. Once the update is verified and installed, turning Safe Web back on simply re-establishes the proxy.

Here is how to check your iPad’s system settings to verify that Norton’s VPN/Proxy loop is fully disconnected before you start your next software update:

Step-by-Step Verification

1. Open the Settings app on your iPad.
2. Tap on General on the left-hand menu.
3. On the right side, scroll down and tap on VPN & Device Management (on some older iPadOS versions, this may just say VPN).
4. Look under the VPN section:

• If it says “Not Connected”: The proxy loop is successfully paused. You are safe to go back to Settings > General > Software Update and run your update.
• If it says “Connected” or shows a checkmark next to “Norton 360” / “Norton Web Protection”: The proxy is still filtering your traffic. Tap the “i” (Information) icon next to the Norton profile and toggle Connect on Demand to Off, or manually disconnect it.

Alternative Quick-Check
You can also look at the very top-right corner of your iPad screen (where your battery and Wi-Fi icons are). If you see a small “VPN” icon, Norton’s proxy is actively running. Once you turn off Safe Web in the Norton app, that icon should disappear, signaling that your path to Apple’s update servers is clear.

AI sourced content may make mistakes
Caveat: I’m not iOS

[kare2k]

@bjm Thank you so much for your reply and extensive information. I should have noted that I do update thru Apple’s Devices app on my computer, and made sure it was the most recent version. Their updates are so huge that I cannot update any other way. I wasn’t aware that there is a downloadable file I could use. Windows 11 doesn’t recognize the old iTunes anymore, but directs to the Devices app (at least on my laptop). This has been happening for the last few updates, causing only restoration a couple of times dictated by the update. This last time by disabling Norton it actually finished without restoring thank goodness.

So, if I understand your post correctly, could disabling Safe Web would be a workaround? or just the Smart Wall next time?

[bjm]

@kare2k

could disabling Safe Web be a workaround? or just the Smart Wall next time?

Hello @kare2k

When you turn on Safe Web (or Web Protection) inside the Norton app, it cannot just “look” at your internet traffic from the outside due to Apple’s strict privacy rules. To get around this, Norton installs a local VPN or proxy configuration directly into your iPad’s system settings.

Here is exactly how that setup creates the issue you are experiencing:

• The Local Proxy Loop: When Safe Web is active, all inbound and outbound internet traffic on your iPad is forced to route through this local Norton proxy loop so it can scan web addresses for malicious links.
• The Apple Security Conflict: When your iPad tries to download a software update, it has to establish a highly secure, direct, and uninterrupted handshake with Apple’s official update verification servers.
• The False Positive/Timeout: Because Apple’s security protocols detect that a third-party proxy (Norton) is intercepting and filtering the connection, it treats it as a security risk or simply times out. This causes the update process to completely freeze partway through.

By toggling Safe Web to “Off”, you temporarily dismantle that local proxy loop. Your iPad is then allowed to make a direct, unfiltered connection to Apple’s update servers. Once the update is verified and installed, turning Safe Web back on simply re-establishes the proxy.

Here is how to check your iPad’s system settings to verify that Norton’s VPN/Proxy loop is fully disconnected before you start your next software update:

Step-by-Step Verification

1. Open the Settings app on your iPad.
2. Tap on General on the left-hand menu.
3. On the right side, scroll down and tap on VPN & Device Management (on some older iPadOS versions, this may just say VPN).
4. Look under the VPN section:

• If it says “Not Connected”: The proxy loop is successfully paused. You are safe to go back to Settings > General > Software Update and run your update.
• If it says “Connected” or shows a checkmark next to “Norton 360” / “Norton Web Protection”: The proxy is still filtering your traffic. Tap the “i” (Information) icon next to the Norton profile and toggle Connect on Demand to Off, or manually disconnect it.

Alternative Quick-Check
You can also look at the very top-right corner of your iPad screen (where your battery and Wi-Fi icons are). If you see a small “VPN” icon, Norton’s proxy is actively running. Once you turn off Safe Web in the Norton app, that icon should disappear, signaling that your path to Apple’s update servers is clear.

Disabling Safe Web is the exact app-level workaround you want to use next time.

You should not look for a “Smart Wall” or “Smart Firewall” setting on your iPad. Norton’s Smart Firewall is a feature built strictly for Windows and macOS desktops. It handles standard desktop-grade network packets, ports, and deep traffic routing rules.

Because Apple’s iPadOS mobile architecture is locked down, Norton is physically incapable of running a true desktop-style Smart Firewall on your tablet. Instead, Norton rebrands its mobile network filtering layer as Safe Web (and Web/Wi-Fi Security) on mobile devices.

Your Best Playbook for Next Time:
When the next iPadOS software update drops, simply treat the Safe Web toggle as your master switch:

1. Open the Norton 360 app.
2. Flip Safe Web to Off.
3. Run your Apple Software Update cleanly without the freeze.
4. Flip Safe Web back to On once the update is complete.

AI sourced content may make mistakes
Caveat: I’m not iOS

Please share your progress – next time.

[bjm]

Set up Safe Web in Norton 360 app on your iOS device

If your iPhone or iPad won’t update

[kare2k]

@bjm Again, thank you SO much for your reply and education. I’ll work on this for the next update and I will share my progress. Have a great rest of the day and week.