When I try to visit a website that hasn't configured https correctly, this message pops up in Safari.
I appreciate the warning—it lets me know not to enter any personal information on the website. However, if the site is e.g. a standard blog, I still want to read it. So I click "Show Details" and then "visit this website".
This causes Safari to ask for my admin password, in order to make "changes to [my] Certificate Trust Settings". I don't want to make any lasting changes to my system, just read one website! Am I somehow making my computer permanently less secure, and if not, why does Safari need my admin password?
What is actually happening behind the scenes when I update my Certificate Trust settings in order to view one of these sites?
Best Answer
When you enter your password and press Update Settings, what really happens is that the certificate presented by that web site is added to the Certificates set in your login keychain. Your password is needed in order for Safari to have permission to add something to your keychain.
If you open up Keychain Access.app, select the login keychain and then the Certificates category, you'll find the specific certificate in the list on the right. The certificate is marked with a blue circle with a white plus inside it. This means it is marked as "trusted".
I.e. you're essentially overriding standard system behavior and stating that you trust a specific certificate even though it is not otherwise trusted (for example because it is expired). This is what will allow you to browse the site without further warnings.
Does it make your computer permanently less secure? - In some ways yes, because you're now trusting a certificate that is not really valid. If some malicious person used that certifcate to trick you then the system will trust that certificate. As you're manually stating that you do indeed trust the certificate, you're already aware that something is out of the ordinary, so it's not a huge problem. You just need to be aware that the trust doesn't automatically "expire" and disappear the next day or something like that.
If you want to manually revoke your trust, you can use Keychain Access.app to right-click on the certificate to Delete it. If you visit the same web site again with Safari, you'll get the warning again.
Note that some browsers (including Safari in Incognito Mode) solve the problem with overriding invalid certificates by allowing the user to override the warning temporarily. In that case nothing is added to the keychain, thus you do not need to enter a password. You can then browse the web site, but after you have closed down your browser, you'll get warnings again the next time you visit the site.
Also note that in these cases, you're only overriding the warning for that specific browser session. I.e. if you're using some other application (i.e. not the browser) to communicate with the site, such as a temporary override won't work. In contrast, doing what Safari does means that other programs (using the system trust store) will also respect your trust in that site.