Do you know where I can find the self-signed root certificate of a website that I have chosen to trust in Safari? It is not showing up in KeyChain.app
People say I can clear Safari cache to remove the certificate but I want to install it in my keychain permanently
It is actually for my router configure page.
iMac 27″, macOS 12.6
I spoke to a Senior service rep at Apple and they could not tell me the answer. They said all certificates I have accepted should be stored in Keychain Access.
I explained that this is for a router on my network that uses a self-signed certificate. It has blocking features for certain websites. When I visit a page I have blocked I get a warning from Safari. I can override that and Trust the cert because I know it's safe. However, when I trust the certificate it's not stored anywhere I can locate it on macOS.
Since I have decided to trust it I should also be allowed to change my mind and remove it - his reply was that this cert would expire and therefore isn't an issue and that I didn't understand - maybe I don't agree and maybe I don't understand. I pointed out that the expiration date for the self-signed cert was in 2030 and I would like it to remain installed whether I clear Safari cache or not. When I restart my computer this certificate that Safari has stored somewhere is not removed.
A lot of people on here will say this is a non-issue. I disagree. When we trust any certificate we should be able to interact with that in a user friendly way. At a minimum it should be visible in Safari when we visit that URL.
As a workaround to not being able to locate the trusted cert on my system, and thanks to some useful information here, I installed the manufacturer's certificate and my trust setting in the Keychain.
openssl s_client -connect {HOSTNAME}:{PORT} -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
replace {HOSTNAME}:{PORT} accordingly. Hostname of router and 443 in my case.
Then click on .pem file to install into your keychain.
I spoke to a Senior service rep at Apple and they could not tell me the answer. They said all certificates I have accepted should be stored in Keychain Access.
I explained that this is for a router on my network that uses a self-signed certificate. It has blocking features for certain websites. When I visit a page I have blocked I get a warning from Safari. I can override that and Trust the cert because I know it's safe. However, when I trust the certificate it's not stored anywhere I can locate it on macOS.
Since I have decided to trust it I should also be allowed to change my mind and remove it - his reply was that this cert would expire and therefore isn't an issue and that I didn't understand - maybe I don't agree and maybe I don't understand. I pointed out that the expiration date for the self-signed cert was in 2030 and I would like it to remain installed whether I clear Safari cache or not. When I restart my computer this certificate that Safari has stored somewhere is not removed.
A lot of people on here will say this is a non-issue. I disagree. When we trust any certificate we should be able to interact with that in a user friendly way. At a minimum it should be visible in Safari when we visit that URL.
As a workaround to not being able to locate the trusted cert on my system, and thanks to some useful information here, I installed the manufacturer's certificate and my trust setting in the Keychain.
openssl s_client -connect {HOSTNAME}:{PORT} -showcerts </dev/null 2>/dev/null|openssl x509 -outform PEM >mycertfile.pem
replace {HOSTNAME}:{PORT} accordingly. Hostname of router and 443 in my case.
Then click on .pem file to install into your keychain.
Here’s an overview:
Here’s how to import a self-signed (public) cert into Keychain from the Apple docs, for those times when Safari on macOS doesn’t:
Add certificates to a keychain using Keychain Access on Mac - Apple Support
Usual spot to import these certs on macOS is in the local keychain, though the system keychain is also available for sharing a trusted cert.
My usual preference for sharing these certs is to use a management profile for the certs I plan to share, or (a little more complicated) to set up a private certificate authority and CSR and sign my own certs and load a management profile with that root public key and load that root cert public key management profile everywhere.
Where I can find the self-signed root certificate of a website that I have chosen to trust in Safari?
