Safari can't verify the identity of website. What to do?

Question

Level 1

64 points

Safari can't verify the identity of website. What to do?

I am getting a "certificate invalid" message using Safari on a number of sites, including my bank, Apple iTunes, insurance company, and many others. The message is: "Safari can't verify the identity of the website (then the specific site is named)". I have spoken with my bank and they say it is an issue with Safari and I should try another browser. I tried Firefox and the connection to the sites is perfect, no issues or warnings at all. What is wrong with Safariu and what, other than stop using it, can be done to correct the certificate issue?

OS X Mountain Lion (10.8.5), iMac, MacBook Pro, and MacBook Air

Posted on Apr 23, 2015 8:52 AM

Reply

Answer 1

Linc Davis

Level 10

209,547 points

Apr 23, 2015 10:50 AM in response to rahimac

Back up all data.

Unlock the Network preference pane, if necessary, by clicking the lock icon in the lower left corner and entering your password. Cllck Advanced, open the DNS tab, and change the server addresses to the following:

8.8.8.8

8.8.4.4

That's Google DNS. Click OK, then Apply.

In Safari, select

Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data

and confirm. If you’re using another browser, empty the cache. Test. Any difference?

Notes:

1. If you lose Internet access after making the above change to your network settings, delete the Google servers in the Network preference pane, then select the TCP/IP tab and click Renew DHCP Lease. That should restore the original DNS settings; otherwise restore them yourself. Remember that you must click Apply in order for any changes to take effect.

2. I don't use Google DNS myself, though I have tested it, and I'm not recommending it or any other DNS provider; the server addresses are offered merely for testing purposes. There may be privacy and technical issues involved in using that service, which you should investigate personally before you decide whether to keep the settings. Other public DNS services exist.

Reply

Answer 2

Eric Root

Level 10

684,039 points

Apr 24, 2015 7:47 AM in response to rahimac

From Safari Help

Change the trust settings of a certificate

You can view or change a certificate’strust policies in Keychain Access.

Open Keychain Access for me

In the Category list, select a category.
Select a certificate, then choose File > Get Info.
Click the Trust disclosure triangle to display the trust policies for the certificate.
To override the trust policies, choose new trust settings from the pop-up menus.

Safari Certificate not recognized

Reply

Answer 3

rahimac Author

Level 1

64 points

Apr 25, 2015 9:58 AM in response to Linc Davis

Linc and Eric: Thank you for your advice. I, however, chose another path due to several concerns: 1) possible impact on LastPass Password Manager I use; 2) concern about removal of all website data in light of no other recommendations along that line; 3) presence of this issue on my iMac but its absence from my wife's MacBook Air (both operating in the same room over the same internet connection with the same versions of OS and Safari). Instead, took my iMac to the Apple Store Genius Bar and displayed the Certificate issue for analysis and resolution. Genius bar staff changed the Certificate setting on several sites with the Certificate issue to "Always Trust" and told me I'd need to go to each site where it is an issue and do the same. Have done so and no longer seeing Certificate issue presence on site going to.

Reply

Answer 4

rahimac Author

Level 1

64 points

May 1, 2015 3:00 PM in response to rahimac

Linc and Eric: Follow-up Notes. After the Apple Genius Bar gave me direction to change all certificates to Always Trust, things seemed to work. However, since that time I began to get some new "Certificate" notifications. I then applied your recommendation, Linc, wherein the DNS tab info was changed and a Remove All Website Data action was taken. This appears to have cleared the matter. I tried it with the DNS set on first, the alternate Google DNS address you provided and then second, after changing the DNS address back to the regular one. The absence of Certificate Notifications worked both ways.

Again, thanks to both of you for your interest in my issue and the advice your provided. I believe (hope) I am out of the woods now.

Reply

Answer 5

Eric Root

Level 10

684,039 points

May 2, 2015 7:37 AM in response to rahimac

You are welcome.

Reply