22

When connecting to a URL via HTTPS and the SSL certificate doesn't match (such as at a paid Wi-Fi hotspot), iOS shows a dialog asking whether the certificate should be accepted. If you accept the certificate, iOS adds an SSL exception and will never ask about that certificate again.

There are possibly two aspects to this: certificates accepted in Safari, and certificates accepted for network services in other apps.

The question is, how does one remove these exceptions, short of a full device reset? There seems to be no way to view or remove exceptions in the device settings.

  • 2
    not an answer, but related so I'm commenting here. A cool iOS app for examining certificate chains is SSL Detective. SSL Detective loads and displays SSL certificates and verifies SSL certificate chains. – chillin May 13 '14 at 18:12
  • You do realize the security implications involved here, right? – Andrew Larsson May 20 '14 at 21:00
  • 4
    @AndrewLarsson Yes, I understand the security implications. That's the whole point. If you accidentally accept an SSL exception you are forever subject to a security hole with whatever certificate you accepted, unless you can remove the exception. – David Diaz May 22 '14 at 19:52
7

I found a nice blog post that gives some good information and tips regarding ssl certificates.

Once the SSL exception is added there doesn’t seem to be a way to remove it in iOS 7. In previous versions going to Settings->Safari and selecting ‘Clear Cookies and Data’ would delete it. This no longer seems to work in iOS 7....

--

To remove the SSL exception on Safari on iOS 7.0.4 you can reset all settings (General > Reset > Reset Settings). Unfortunately it deletes all your settings (go figure); but it's one huge step better than a full restore that makes you lose your text messages.


I found instructions on how to do this in iOS 6 here and also here with pictures. This probably also works in iOS 5 but I cannot confirm (the Profiles page mentioned below likely doesn't appear until there are installed certificates to view or delete). See information about how this changed iOS 7 below if this doesn't also work there.

Remove Security Certificates

from the first link above:

  • Turn on your iPhone and click on the "Settings" icon in the main menu screen. Select "General" from the list of options that appear in the drop-down menu.

  • Select "Profiles" from the list of options that appear and a list of all the certificate on your iPhone will appear on screen.

  • Scroll through the list of certificates until you come to the one you would like to remove from your iPhone and click the "Remove" button on the screen. The certificate will then be removed. Repeat the process for any other certificates you would like to remove.


You can also manage certificates with the Apple Configurator in Mavericks, the iPhone Configuration Utility in Mountain Lion, Lion and Snow Leopard, and there is a Windows version. There are instructions available.


Information on how this changed in iOS 7.


SSL Detective

From my comment above, check out SSL Detective for iOS. As far as I've seen, it's the only iOS app of it's kind, and may help you determine which certificates you'd like to delete.

  • Whilst the former works for certificates that have been marked trusted with profiles, most of the time (as I believe has been the case with the OP) the certificate was trusted on the page load, which doesn't add a profile? With regard to the latter, the free version isn't available on the UK store so I can't test but it appears that it only looks at certificates marked as trusted by profiles, not by Safari? – grg May 13 '14 at 18:38
  • @grgarside I believe you are correct, which is why I added the bit about the Apple Configurator / iPhone Configuration Utility. I believe those will let you remove them even if no Profile exists in Settings/General. I wonder if emailing yourself a self-signed certificate will allow this Profile page to appear and give access to deleting other certificates. idk. Whatd'ya think? – chillin May 13 '14 at 18:43
  • Ah, didn't see the 'post has been edited' banner :) Apple Configurator doesn't let you as far as I know (can you provide instructions), and the instructions you linked to for iPhone Configuration Utility specifically mention 'Configuration Profile Removal' which aren't created on the per case basis of Safari approval? – grg May 13 '14 at 18:45
  • 2
    I am constantly making changes... stuff gets better. Stuff gets better all the time. ;-) – chillin May 13 '14 at 18:46
  • 1
    I found this question/answer while trying to figure out why Safari was giving the "not trusted" dialog box to begin with. SSL Detective for the win! It helped me detect that the server was missing the intermediate certificates that complete the validation chain. Once those were installed and configured on the server it worked flawlessly. Thanks! – Tim Lewis Oct 22 '14 at 21:49
6

You can delete the SSL certificate.
Go to Settings → General → Reset → Network Settings.
This resolves the problem.

[EDIT]

As of iOS 10.3.2 this does NOT work. Instead it wipes out your network settings, but does NOT remove certificate exceptions.

  • 3
    This also resets the rest of your network settings. Apple really dropped the ball here. – cjm Mar 5 '16 at 1:05
1

Another one for SSL Detective. For some reason the last iOS 6 compatible version of an app I use daily suddenly stopped working with an Untrusted Root Certificate error saying "The authenticity of "GeoTrust Primary Certification Authority - G3" cannot be verified." I could have used SSL Detective's "Email Certs" feature to just install the cert and trust it myself, but that wouldn't have gotten to the ROOT Cause of the issue. (no pun intended)

The necessary Root Certificate was found here: I browsed that website from Safari on my iPhone and clicked to install the G3 (SHA256) root certificate and it totally solved my problem.

Also, this GeoTrust utility will come in handy for future readers to verify the website they're visiting has correctly configured SSL in the first place: SSL Certificate Checker

1

For iOS Safari 9.0 Mobile/13E230 Safari/601.1 running in an iOS 9.3 (13E230) Simulator, the only option I've found is "Reset Content and Settings" from the "Simulator" menu in the toolbar.

0

I found the answer at http://kb.mit.edu/confluence/display/istcontrib/Deleting%2BPersonal%2BCertificates%2Bfrom%2Ban%2BiOS%2Bdevice

Settings > General > Profile

Profile is near the bottom, right under VPN.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .