IOS – “err_certificate_invalid” for only one host, on only one device, but in all browsers

certificategoogle-chromeiosipadssl

Currently, when I try to access www.comic-rocket.com on my iPad (iOS 10.2), the site will not load.

  • Safari simply won't load the page, as if I hadn't even tried to do so.
  • Chrome and Dolphin will show a "ERR_CERTIFICATE_INVALID" error message. Chrome details it as having received a scrambled certificate.

The issue does not occur on Windows, on Android, or on a friend's iPhone, i.e. it seems to be uniquely tied to my specific device. Update: On a colleagues iPad Pro I can finally reproduce the issue. Probably my friends don't have the latest iOS installed, where StartCom should be removed as valid certificate authority, see jksoegaard's answer.

Is there some way I may solve this, short of fully resetting the device?

I already tried:

  • Hard-Reset of the device (holding power- and home-button until the device restarts).
  • Resetting network settings
  • Resetting "All Settings"
  • Downloading the certificate on Windows, mailing it myself and installing it from the "Mail" app (doesn't work from Gmail).1
  • In a related thread2, deleting everything under "Settings > General > Profiles" (may be called "Device management" instead of "Profiles") was suggested. This entry however didn't even exist until I installed the certificate manually (i.e. there was nothing do delete).

Footnotes

1 In order to download the correct certificate, I had to disable my Antivirus temporarily, since it injects its own root certificate. Using "SSL Detective" on iOS, I checked that the certificates received by the iPad and by Chrome on Windows match.
2 Certificate error when using Chrome for iOS with company CA

Best Answer

Your certificate is issued by StartCom. The company has recently endured a number of scandals where they broke the rules governing certificates.

This means that for example new versions of Firefox does not trust StartCom certificates issued after the 21st of October 2016. Your certificate is from 2017.

Your problems are probably caused by this. The iPad likely has newer software/certificate updates than your Windows or Android device.

In time expect that no one will accept your StartCom certificate.

I suggest replacing the certificate with a new certificate!

Related Question