5

I started seeing an issue in Chrome (38 on OSX 10.7.5) accessing GitHub. I got a Privacy error. One of the recommendations on SuperUser, and the reply I got from GitHub support, was to delete all expired certificates in Keychain Access, close the browser, and reboot the machine. I followed the advice.

Now, I cannot access many other sites: LinkedIn, StackExchange sites etc. - all with the same error. I'm forced to use another browser (which btw, shows an error next to the HTTPS lock icon). The Keychain Access certificates view does not repopulate. I might have deleted something I shouldn't, but shouldn't new certificates be downloaded as needed? What do I need to do to gain access to all the HTTPS sites again?

Improve this question
4
  • Do you have a backup? If so, you can restore the files. If not, you can back up, erase and reinstall the OS and then restore the backup.
    – bmike ♦
    Commented Jul 29, 2014 at 18:29
  • 2
    Reinstall the OS? For SSL certificates???
    – Traveling Tech Guy
    Commented Jul 29, 2014 at 18:30
  • There is a user keychain, a system keychain and frankly, the procedure to do that is well documented and it takes about 3 minutes of your time to execute things. Who says you'll not make things worse by trying to muck with ssl trust chains... The lack of detail in your post made me choose the easiest fix for you. I'll make a real answer with the locations of the files you have mistakenly removed parts of the trust chain.
    – bmike ♦
    Commented Jul 29, 2014 at 18:31
  • The same thing happened to me I need help it said it didn't have a secure connection so I searched up advice and it said to delete all keychains that looked useless. I did that not thinking about what I was doing, and now I can't access anything on google chrome.
    – Scott Gressman
    Commented Sep 8, 2017 at 4:06

2 Answers 2

Reset to default
6

Restore the contents of these three directories from a recent backup:

~/Library/Keychains
/Library/Keychains
/System/Library/Keychains

On my system this comprises 18 files and a subdirectory in the user folder ~/Library/Keychains

Improve this answer
7
  • I do not have a backup. All I want to do is force the browser to re-download the certificates. I'm not sure what's missing there.
    – Traveling Tech Guy
    Commented Jul 29, 2014 at 20:36
  • 3
    The trust chain doesn't work that way on OSX. It would be a huge security risk to have the browser heal itself downloading new certs from the Internet, no?
    – bmike ♦
    Commented Jul 29, 2014 at 21:08
  • So how did the certs get there in the first place?
    – Traveling Tech Guy
    Commented Jul 29, 2014 at 21:30
  • 1
    I can't even begin to guess what cert chain you had. They can be added by MDM profile, file if the user takes action, but the vast, vast majority of people only get certificates in their keychain as part of the OS initial installation and OS updates from Apple exclusively.
    – bmike ♦
    Commented Jul 29, 2014 at 21:36
  • 1
    @TravelingTechGuy Sorry for the late response. Apple stores the root certificates in the keychain so that some trust can be pre-established. I'm more familiar with Safari, but pretty sure that Chrome on OS X also relies on elements stored in the keychain to root the chain of trust. Basically everyone that gets in this door, can have their root certificate shipped with Apple updates: apple.com/certificateauthority/ca_program.html
    – bmike ♦
    Commented Mar 19, 2015 at 14:11
2

I finally solved the issue by opening the web sites that misbehaved, one at a time, in Safari. From there you proceed to trust each and every certificate. They are then re-added to your keychain. More can be found in this KB.

I'd like to thank @bmike for doing his best to assist. Restoring from backup would probably work (if I had one - silly me).

Improve this answer
2
  • 1
    Nice answer - be sure to tick it as the solution when the timeout expires. Glad you found the add one cert option. Also, I realized you might get everything back in order if you apply the latest combo update from apple.com/downloads...
    – bmike ♦
    Commented Jul 30, 2014 at 3:48
  • 1
    I believe that another solution to this problem would be to "Reinstall OSX" just not fresh. When you boot to recovery and reinstall, it just puts a fresh copy on top of what you have and doesn't modify any user data, so running a reinstall would also restore the certs on the system :)
    – sofly
    Commented Jun 18, 2015 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .