Certificate lifespan issues with internal CAs in Safari on MacOS and IOS

Safari (current versions) continues to complain about certificates with lifespans of over 398 days when issued by our internal CAs that have had their root and intermediate certificates added to they keychain. Are there any other conditions that affect this?

iMac 27″, macOS 10.14

Posted on Jan 20, 2022 12:06 PM

Similar questions

Certificate error on El Capitan but not High Sierra I have been having an ongoing issue with my online banking related to a certificate issued by fisglobal. This started about 2 years ago. On my MacBook runing El Capitan, when accessing some pages of the bank website Safari and Chrome both give error messages that the certificate cannot be trusted. Firefox sometimes accepts the certificate, sometimes does not. On my iMac running High Sierra, I do not have the issue in Safari (only browser I use). So when paying my bills, sometimes I can do it from the laptop using Firefox and sometimes not. The only workaround is to use the iMac, either by screen sharing or going to the room where it is located (NOT my home office). Both computers are at their final supported OSes, so I can't just update the laptop OS to fix the problem. When I use Keychain Access to check my certificates, I do not even see a certificate for fisglobal on either machine. So the usual advice to delete the certificate and rebot to force a new one to be downloaded doesn't work...nothing to delete! I used to see the certificate, where did it go? Is there some secret method to show "hidden" certificates?
2476 2
Internal Certificates not trusted by iOS after Sept 1st, 2020 with validity period greater than 398 days.. The following post indicates that iOS devices will not trust certificates after Sept 1, 2020 with a validity period greater than 398 days for Root CAs pre-installed devices. This article also indicates that user or administrator added root CAs will not be affected. About upcoming limits on trusted certificates - Apple Support We took this to understand that our internal certificates from our company would not be affected, however this is not true. We found a workaround by setting a browser setting to trust all certs, however, some apps like Power BI do not work with the workaround in place. Is there any confirmation Apple can give that this would also affect the trust of certs not issued by public Root CAs but our own internal Root CA?
4085 2
Security Certificates I am having trouble with internet sites being blocked because of expired security certificates. I have a MacBook Pro (purchased in 2015), running OS X El Capitan. I have not been able to resolve this issue and it is getting worse. Do I have to re-load these certificates? Where do I get them and can they be re-loaded. This topic is very unfamiliar to me.
1269 1

1 reply

ecarlseen Author

Level 1

10 points

Jan 20, 2022 12:09 PM in response to ecarlseen

Update: Answer found here.

https://discussions.apple.com/thread/252689988?answerId=255201233022#255201233022

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Certificate lifespan issues with internal CAs in Safari on MacOS and IOS

Welcome to Apple Support Community

A forum where Apple customers help each other with their products. Get started with your Apple Account.

Learn more Sign up