Safari not accepting website certificate

certificatekeychainsafari

I've been using an internal website at work without any issues until today when I received the error message:

"Safari can't open the page "https://…". The error is: "The server "…" did not accept the certificate." (NSURLErrorDomain:-1205)

I've looked in my Keychain to see if there was a certificate that I could delete and re-add, but nothing shows up there matching the URL of the website. I've fixed this problem once in the past (accidentally) by deleting my entire keychain and starting over but I didn't mean to do it the first time and I'd rather not do it again.

The website does load without an issue in other browsers without any errors/warnings. It's just Safari that's barfing.

Has anyone else seen this? Know how to fix it?

Best Answer

I've since solved the problem, though I'm not sure if this is the right answer for everyone.

The problem seemed to come from the certificate automatically generated from apple (com.apple.idms.appleid.prd.[large character string]). A quick Google search didn't tell me what this certificate was for, but I'm sure that deleting it was probably not the best solution. Ignoring that thought, I deleted it anyway and now I can log in without a problem. I'm sure that something bad will happen with other things on my computer (private key, other certificates, something), but it hasn't happened yet so I'm calling it a win.

UPDATE:

A couple of months on, I still haven't had anything bad happen so I guess this solution didn't break anything else.

UPDATE 2:

About a year on, this problem still comes up from time to time (even with 10.10). I keep deleting the certificate in the keychain and it keeps working for a while.

Related Solutions

MacOS – Safari not warning on SSL certificate hostname mismatch

So, as noted in the update, Safari does actually warn you -- once.

If you decide to proceed anyway, then for the remainder of that browser session, you need to remember that you're talking to a potentially compromised server, because you will see no evidence of that except by examining the certificate (by clicking on the https/padlock icon).

However, exiting Safari and restarting it restores the warning. A visit to the compromised site in the new instance of the browser once again presents the warning.

MacOS – Safari not loading Gmail; Google/YouTube invalid certificate

A few things to check.

You said you uninstalled your extensions. Are they definitely gone? Check the following folder. It should be empty except for an Extensions.plist file.

/Users/YOURUSERNAME/Library/Safari/Extensions

You mentioned extensions but not plugins. Within Safari's preferences go to the Security tab and click on the button "Website Settings..." beside "Internet plug-ins". Uncheck anything you don't recognise there and try again. Especially, obviously, anything enabled for Google's sites.

Another thing to check is the proxy settings on your Mac. A quick way to access these is from the Advanced tab in Safari's preferences. There should be a "Change Settings..." button beside "Proxies" near the bottom of that tab that will launch System Preferences and take you right to the proxy settings. Hard to give you guidance beyond this, but look for any proxy settings that you haven't configured yourself.

One last thing to check for is malicious or buggy kernel extensions. While it's unlikely on Yosemite (as kernel extensions now need to be signed to load) it might be worth checking anyway. Open the Terminal application and type the following command it will list any kernel extensions that don't identify as coming from Apple.

kextstat | grep -v "com.apple"

Failing that a useful tool to help people diagnose problems is EtreCheck. Download and run it and paste the output into a Gist and update your question with the link.

Best Answer

Related Solutions

MacOS – Safari not warning on SSL certificate hostname mismatch

MacOS – Safari not loading Gmail; Google/YouTube invalid certificate

Related Question