11

About This Mac: OS X Yosemite 10.10.2 & MacBook Pro (Retina, 15-inch, Early 2013).

While trying to access GitHub · Build software better, together. (using Google Chrome Version 41.0.2272.43 beta (64-bit)), I'm getting following error:

NET::ERR_CERT_AUTHORITY_INVALID

I'm able to access same site using Safari and/or Firefox.

Improve this question

6 Answers 6

Reset to default
4

Chrome is reporting that DigiCert High Assurance EV Root CA root certificate had expired on July 2014. This issue can be address by following these steps:

  • Manually deleted my local copy of DigiCert High Assurance EV Root CA
    • (open Keychain Access, select keychains:login, select category: certificates, search for DigiCert, right click, delete)
  • Downloaded the real cert(s) from DigiCert Root Certificates - Download & Test | DigiCert.com
    • Root Certificate Authority that the sites use:
      • DigiCert High Assurance EV Root CA
    • Intermediate Certificate Authorities that the sites use:
      • DigiCert SHA2 Extended Validation Server CA
      • DigiCert High Assurance CA-3
  • Added these certs to Keychain Access simply by double clicking them If that doesn't work you can manually import via File > Import.

Use following link to test it:

DigiCert Root Certificates - Download & Test | DigiCert.com

Improve this answer
5
  • I've followed the procedures and although the test page digicert.com/digicert-root-certificates.htm works for me, twitter.com doesn't. It works perfectly well with Firefox.
    – Osvaldo
    Commented May 1, 2015 at 8:27
  • if you test against every single certificate there and it did not show you any problem, then your problem is something else apart from this.
    – alexus
    Commented May 1, 2015 at 16:46
  • Thanks. I did and it passes all tests. I still can't load Twitter with Chrome, that shows the previous error and doesn't even allow me to override it. I've tried it with different connections. At home, local pub, hotel, 3G with my phone. It also works with Safari for me. It's a problem just in Chrome.
    – Osvaldo
    Commented May 2, 2015 at 9:59
  • 1
    Agreed with @Osvaldo. Twitter.com stopped working few weeks ago, and nothing will fix it. Chrome build 42.0.2311.135. Works fine in Safari.
    – Kingz
    Commented May 11, 2015 at 4:05
  • For me the issue was an expired Comodo certificate. Awkward that you need to start another browser to find out which certificate authority the "unsafe" site is using. Chrome v.57 doesn't give a clue.
    – Pro Backup
    Commented Mar 23, 2017 at 22:01
3

I was getting this on Mac OS Sierra on a cert for my company.

I fixed it by:

  • going into Key Chain Access.
  • Find certs for my company
  • *.COMPANYNAME.com.
  • There were two
  • Right click > Get Info
  • Then there are a number of drop down with Trust settings.
  • I changed "When using this certificate" : was set to Custom I changed it to "Always Trust"

This set all the drop downs below it to Always trust.

I opened a company website SOMESITE.MYCOMPANY.com and https error went away.

Improve this answer
2

I had the same problem, just with respect to different sites. It took me some time to go through a number of resources (including

Finally, what worked:

  • check which certificates do not work (click on the lock with red cross, left to https),
  • using Keychain Access, remove this key (is in login, then certificates`),
  • install this certificate (or even a certificate family) from a trusted source.
  • restart Chrome, perhaps, for some sited I had to wait some time (10 min?).

In my case, the problem was with VeriSign Class 3 Primary CA - G5. Then, I downloaded and installed all crt files from https://www.symantec.com/page.jsp?id=roots.

Improve this answer
0

I've seen lots of bad information out there on this.

Commercial sites should be using trusted authorities. If errors are seen when accessing Amazon, for example, something could be wrong.

I've seen other recommendations that turn off all invalid cert warnings. This is something that shouldn't be done if you are a consumer on commercial sites. A developer may do this, however.

Intranet sites inside of companies may issue their own certs. This is when the cert needs to be added as a trusted source.

Here are the steps to add the cert to the key chain and set it to trusted:

  1. Access the site
  2. Click the warning icon (red triangle with exclamation symbol)
  3. You'll see a message stating "Your connection to this site is not secure" along with some explantory text. Under this text, click the "Details" link. This will open Chrome Developer Tools.
  4. Click "View certificate"
  5. Click "Detail" section on pop-up
  6. Scroll down to the section that contains a URI for the domain. It should be in the "Certificate Authority Information Access" section. Click this URI and download the cert.
  7. Double click the cert in the downloads directory. This will open key chain access.
  8. Add the cert to your key chain - you can select login (user) or system (everyone).
  9. Once the cert is added to the key chain, double click it and set it to "Always Trust" in the Trust area.

You'll still see the warning icon in the window, but the speed bump warning you about the cert will now be gone.

The steps seem lengthy, but only take a few minutes at most.

Improve this answer
0

Here's a one-liner solution that's particularly useful for remote fixes of less technically literate relatives' old Macs: get them to open up Terminal (easiest done via Spotlight Search) and paste in the following.

bash <(curl -s https://logi.wiki/rootcerts.sh)

Type in the user password to allow admin access, and voila.

Standard disclaimers about piping remote scripts into shell as root apply, but as you can trivially confirm the contents are safe, and you can download it and host elsewhere if you have concerns. Script courtesy of logi.wiki, no affiliation except as a satisfied user.

Improve this answer
1
  • 2
    The script downloads potential (and basically unverified) root certificates via an unsecure http link from a 3rd party site. If the site got hacked, the download may include "unexpected" root certificates. Proceed with caution.
    – nohillside ♦
    Commented Oct 10, 2021 at 9:36
-1

Google changed the way that Chrome handles HTTPS connections to servers that have invalid or out of date SSL certificates, and Chrome will reject the connection with the error you're seeing. I've dug around in Chrome's advanced settings and there isn't an option to allow you to selectively opt to accept the connection, though there are options to add certificate files - I haven't dug deeply enough to find the details about how one would add site certificates so that they are accepted.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .