How to clear Safari SSL client certificate cache?

Question

Level 1

3 points

How to clear Safari SSL client certificate cache?

I have two SSL client certificates which I can use to access an Apache web server via Safari. Let's call them Cert-A and Cert-B. I can use either certificate to authenticate. When I first accessed the web server, a selection dialog popped up and I chose Cert-A for authentication. Now whenever I access the web server, Safari no longer displays a selection dialog, but automatically uses Cert-A. Thus, I cannot switch to Cert-B.

I have deleted all web objects and cookies via Safari preferences, I have cleared my ~/Library/Caches directory, I have rebooted the machine -- it does not make a difference. How can I force Safari to display the certificate selection dialog again? Is there a special certificate cache I can clear?

Thanks for your suggestions.

-Ralph

MacBook Pro with Retina display, OS X Mountain Lion (10.8.2)

Posted on Sep 30, 2012 6:57 AM

Reply

Answer 1

Linc Davis

Level 10

209,535 points

Sep 30, 2012 10:01 AM in response to RS-ASC

Your requirements are unusual. The only way I can think of to get what you want is to have a different URL that resolves to the same page. I would try another browser, such as Firefox or Chromium, that might have more flexible certificate management than Safari.

Reply

Answer 2

Jun 4, 2017 4:04 AM in response to RS-ASC

"I found it by typing part of the domain name into the search box of Keychain, and it shows up a Kind called "Identity Preference". Just delete this", then I had to clear the Safari cache. upon relying into the site I was ale to choose the correct certificate to authenticate.

Reply

Answer 3

Linc Davis

Level 10

209,535 points

Sep 30, 2012 9:21 AM in response to RS-ASC

Safari, Mac OS X 10.5.3: Changes in client certificate authentication

Reply

Answer 4

RS-ASC Author

Level 1

3 points

Sep 30, 2012 9:53 AM in response to Linc Davis

Thanks, Linc. I should have stated that I was aware of this feature. What I want to be able to do is choose the proper certificate from a popup whenever I access the web page. One of the certificates is used for everyday work, while the other is used for administrative tasks. Modifying an identity preference each time I need to switch my role is too cumbersome.

-Ralph

Reply

Answer 5

RS-ASC Author

Level 1

3 points

Sep 30, 2012 10:15 AM in response to Linc Davis

I don't think it is unusual to use different identities for different tasks. One would not work as 'root' for mundane operations. Anyway, Firefox offers a certificate selection dialog, but I'd be rather disappointed if Safari can't provide such a simple thing.

-Ralph

Reply

Answer 6

Feb 19, 2013 2:26 PM in response to RS-ASC

I agree that this is not an unusual requirement. We also have a requirement to test our application with multiple certificates. This is certainly a realistic test scenario. So there is no way to do this in Safari?

Reply

Answer 7

RS-ASC Author

Level 1

3 points

Feb 19, 2013 2:58 PM in response to Karen H123

No method has been suggested to me so far.

Reply

Answer 8

Jun 28, 2013 11:13 AM in response to RS-ASC

friend go to this link

https://docs.gosecureauth.com/pages/viewpage.action?pageId=3146924

Reply

Answer 9

Jul 12, 2013 5:33 AM in response to RS-ASC

I would file a feature request to enhance this with an option like ‘always ask’. However, perhaps it is possible to script this. Apple Keychain has a shell API. Perhaps this is possible with AppleScript as well.

Reply

Answer 10

Mar 18, 2014 8:00 AM in response to Linc Davis

This is not in any way an 'unusual' requirement. Selecting between multiple certificates with varying levels of access is essential when testing - who wants to have to manually assign a certificate every single time they want to switch? This is not an issue in any other major browser.

Reply

Answer 11

Mar 18, 2014 8:18 AM in response to samworley

As workaround, in your OS X, did you consider to create two users, each with its own client certificate? If that is not sufficient, you should file a feature request with Apple Bug Reporter.

Reply

Answer 12

May 1, 2014 3:57 PM in response to RS-ASC

I just had this happen, and noticed when you select a certificate it creates an Identity Preference in the Keychain.

I found it by typing part of the domain name into the search box of Keychain, and it shows up a Kind called "Identity Preference". Just delete this and it will prompt the certificate selection again.

Alternatively, if you double click it you can select the perferred certificate in the dialog.

Reply

Answer 13

Jun 26, 2015 11:42 AM in response to phindmarsh

Worked for me, thanks much

Reply

Answer 14

Mar 29, 2016 6:03 PM in response to phindmarsh

awesome; that worked for me too. I needed to get a CAC card cert instead of a mac one in place.

Reply