Certificates, Keychains, Always Trust, endless loop..save me!

+| open the certificate in keychain+
+| 10-> change everything to "always trust"+
+| close the window...and wait for it to ask for the password...+

Instead of Always Trust, just choose the first option. (Can't remember what it says atm.) Not sure why it works, but it did in my case.

Papahbear wrote:

Before I reset the keychain I noticed that when I changed the certificate I would be asked for my password. The changes would take. I also noticed that the first certificate in the list would not ask for the password.

Which list of certificates?

Have you tried adding the root certificate for the signing authority to the "X509 Anchors" keychain?

- cfr

I don't altogether understand these things either but I think that the root certificates are the certificates for certificate authorities. In other words, suppose there's an organisation which issues certificates to other organisations like ISPs. You get a certificate from your ISP which is signed by the first organisation. The computer then looks to see whether it has a certificate for that organisation. If it does and it is a root certificate, the chain ends - it trusts the root, so it trusts the ISP's certificate, too. Otherwise, it looks to see who signed that certificate in turn. And so on. So all the chains of trust, if you see what I mean (I don't know all the terminology here) have to finally end with a root certificate which the computer trusts. Er... I think.

So your certificate isn't trusted because it is signed by you and you are not a recognised certificate authority with a root certificate installed. If you got the certificate signed by some organisation for which the computer had a root certificate, then it would be trusted. I think the same is true for the certificate you're trying to install. I'm not sure, though. This is sort of a mixture of a little knowledge, a good bit of guesswork and some imagination so don't take my word for it!

I don't know exactly the relevance of being in the X509Anchors vs. not being. That may not be the point. If you look through certificates in Keychain Access, though, you can see differences:
--- certificates with gold borders and gold medallion-type things which seem to be either root certificates or self-signed root certificates
--- certificates with blue borders and gold medallions which seem to be different - e.g. I have one which is an "intermediate certificate authority" which I think means that it is the certificate of a body which can issue certificates to others but it is also signed by another authority which authorises/certifies this use. Or something like that.
--- are there certificates with blue borders and blue medallions? I can't find any but I'm wondering if those would be certificates for bodies which are trusted for purposes other than signing certificates e.g. for email or something but not for issuing certificates. This is definitely into the realm of imagination now, though, as I don't seem to have any certificates like this.

I don't know if this helps but I think you need to figure out who issued the certificate you need to trust and then find the certificate for them and install it. If that's a root certificate, you'd then be done. Otherwise, you'd have to follow the chain back until you get a certificate signed by an authority the computer already trusts (because it has the a suitable root certificate) or one that is itself a root certificate which you can install.

Like I say, this is largely guesswork so don't set much store by it. I hope maybe something in it will give you a helpful clue, though. (Even if it goes via the thought that "that can't possibly be correct"!)

- cfr

(*Note: Try and discard all logic, just perform the steps.*)

1. Open up Mail.app and wait for the certificate warning to come up.
2. Click "Show certificate" and click the arrow next to the "Trust Settings".

Instead of selecting "Always Trust", choose "Use System Settings". (It's the top option, separated from both other options.)

3. Click on the certificate in the list, then check the box "Always trust this certificate".
4. Continue.

Now quit Mail.app and if you're presented with the dialog screen again, simply repeat steps 3 & 4.

If you restart Mail.app again, the message will not re-appear.

After my share of frustration with this issue, I followed FourSeven's instructions and LO AND BEHOLD - IT WORKED! Thanks FourSeven, I feel so calm and relaxed now.

Checking "always trust" would only work for the particular session.
Every subsequent launch of Mail.app would send up the alerts, asking me to "always trust" again and again. This was annoying. Mail.app would not stop asking about the old/bad certs, even after they had been replaced by new ones for a couple of my SSL-IMAP accessed accounts.

The solution I found was to quit Mail, run Keychain Access (util app), locate the concerned keys, and DELETE them. Then run Mail again and "voila", it's all good and happy. no more pesky dialogs.

Holy moo! FourSeven's instructions also worked for me! Thanks a million, this has been bugging me for ages!

Well, it wont work for me...

Only option is to disable SSL, and thats something im not really happy about. Why the f * haven't they fixed this freaking bug. It has been around far too long.

I am going to retract this earlier post. It doesn't work.
I believe that my ISP's ssl cert is expired/invalid. Maybe this is why Mail.app is always asking me over and over to Trust again, even though I have previously checked "always trust". Then, indeed, things do work well when I turn off ssl.

Hi,

Any idea how to fix this in 10.4.11? (It works perfectly on my laptop with 10.5, but not on my G5 with 10.4.11.)

I've tried all of these steps (though they differ between 10.5 & 10.4.11) and I cannot get Mail in 10.4.11 to trust my webhost's certificate. I've tried installing the root certificate, etc. My webhost's tech support has told me that this is a bug in Apple's Mail/Keychain.

Any help would be greatly appreciated.

Thanks!