2

When trying to access a couple of high-profile websites (*.apple.com, twitter.com) via HTTPS, they've since recently been getting their certificates rejected by some client apps (Chrome, App Store, curl) but not by others (Safari, Firefox, wget, lynx).

This is a bit paralyzing, because with App Store unable to talk to identity.apple.com I can't get OS updates anymore.

I'm running OSX 10.9.5 on a 2013 rMBP. I'm not aware of having made any major changes in the system recently. Not using any network-sniffing or otherwise unusual software. I haven't been messing with stored certificate-authority data - I wouldn't even quite know how to do that. I do have Homebrew-installed OpenSSL, if that changes anything.

Could anyone help me fix this?

Improve this question
3
  • 1
    try stackoverflow.com/questions/18964175/…
    – Tetsujin
    Commented Apr 26, 2015 at 8:49
  • Thanks @Tetsujin, that turned out to be a workable workaround for individual sites, but it doesn't seem to fix the App Store problem. (And I'd also hold out hope for a systemic solution that doesn't need manually marking each future troubled site.)
    – hemflit
    Commented Apr 26, 2015 at 9:09
  • 2
    One other option I saw whilst Googling was to open each certificate in Keychain, check for expiration dates [or indeed for anything suspicious, just to be certain] & see if you can re-add trust from there. I don't have any to test, so I can't be more precise.
    – Tetsujin
    Commented Apr 26, 2015 at 9:37

1 Answer 1

Reset to default
1

(With great thanks to @Tetsujin for pointing me in the right direction)

Looking up details of the certificates, in browsers that allow doing that and in Keychain Access, showed that all the breakage was traceable to a "VeriSign Class 3 Public Primary Certification Authority - G5" which was untrusted; I haven't figured out why that was, and it wasn't prominently marked as such in KA.
Anyway, in KA I've set this cert to be "always trusted" on SSL, and everything is now loading well, though the other certs calling upon it are marked as "signed by an untrusted authority".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .