Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I started seeing an issue in Chrome (38 on OSX 10.7.5) accessing GitHub. I got a Privacy error. One of the recommendations on SuperUser, and the reply I got from GitHub support, was to delete all expired certificates in Keychain Access, close the browser, and reboot the machine. I followed the advice.

Now, I cannot access many other sites: LinkedIn, StackExchange sites etc. - all with the same error. I'm forced to use another browser (which btw, shows an error next to the HTTPS lock icon). The Keychain Access certificates view does not repopulate. I might have deleted something I shouldn't, but shouldn't new certificates be downloaded as needed? What do I need to do to gain access to all the HTTPS sites again?

share|improve this question
    
Do you have a backup? If so, you can restore the files. If not, you can back up, erase and reinstall the OS and then restore the backup. –  bmike Jul 29 at 18:29
    
Reinstall the OS? For SSL certificates??? –  Traveling Tech Guy Jul 29 at 18:30
    
There is a user keychain, a system keychain and frankly, the procedure to do that is well documented and it takes about 3 minutes of your time to execute things. Who says you'll not make things worse by trying to muck with ssl trust chains... The lack of detail in your post made me choose the easiest fix for you. I'll make a real answer with the locations of the files you have mistakenly removed parts of the trust chain. –  bmike Jul 29 at 18:31

2 Answers 2

Restore the contents of these three directories from a recent backup:

~/Library/Keychains
/Library/Keychains
/System/Library/Keychains

On my system this comprises 18 files and a subdirectory in the user folder ~/Library/Keychains

share|improve this answer
    
I do not have a backup. All I want to do is force the browser to re-download the certificates. I'm not sure what's missing there. –  Traveling Tech Guy Jul 29 at 20:36
2  
The trust chain doesn't work that way on OSX. It would be a huge security risk to have the browser heal itself downloading new certs from the Internet, no? –  bmike Jul 29 at 21:08
    
So how did the certs get there in the first place? –  Traveling Tech Guy Jul 29 at 21:30
    
I can't even begin to guess what cert chain you had. They can be added by MDM profile, file if the user takes action, but the vast, vast majority of people only get certificates in their keychain as part of the OS initial installation and OS updates from Apple exclusively. –  bmike Jul 29 at 21:36
    
I'm still trying to wrap my head around why sites SSL certificates have anything to do with my keychain, and not browser specific. If I browse to apple.stackexchange.com, shouldn't the browser decide whether it's a bogus cert or not? What does my keychain have to do with it? –  Traveling Tech Guy Jul 29 at 21:43
up vote 1 down vote accepted

I finally solved the issue by opening the web sites that misbehaved, one at a time, in Safari. From there you proceed to trust each and every certificate. They are then re-added to your keychain. More can be found in this KB.

I'd like to thank @bmike for doing his best to assist. Restoring from backup would probably work (if I had one - silly me).

share|improve this answer
    
Nice answer - be sure to tick it as the solution when the timeout expires. Glad you found the add one cert option. Also, I realized you might get everything back in order if you apply the latest combo update from apple.com/downloads... –  bmike Jul 30 at 3:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.