7

About This Mac: OS X Yosemite 10.10.2 & MacBook Pro (Retina, 15-inch, Early 2013).

While trying to access GitHub · Build software better, together. (using Google Chrome Version 41.0.2272.43 beta (64-bit)), I'm getting following error:

NET::ERR_CERT_AUTHORITY_INVALID

I'm able to access same site using Safari and/or Firefox.

4

Chrome is reporting that DigiCert High Assurance EV Root CA root certificate had expired on July 2014. This issue can be address by following these steps:

  • Manually deleted my local copy of DigiCert High Assurance EV Root CA
    • (open Keychain Access, select keychains:login, select category: certificates, search for DigiCert, right click, delete)
  • Downloaded the real cert(s) from DigiCert Root Certificates - Download & Test | DigiCert.com
    • Root Certificate Authority that the sites use:
      • DigiCert High Assurance EV Root CA
    • Intermediate Certificate Authorities that the sites use:
      • DigiCert SHA2 Extended Validation Server CA
      • DigiCert High Assurance CA-3
  • Added these certs to Keychain Access simply by double clicking them If that doesn't work you can manually import via File > Import.

Use following link to test it:

DigiCert Root Certificates - Download & Test | DigiCert.com

  • I've followed the procedures and although the test page digicert.com/digicert-root-certificates.htm works for me, twitter.com doesn't. It works perfectly well with Firefox. – Osvaldo May 1 '15 at 8:27
  • if you test against every single certificate there and it did not show you any problem, then your problem is something else apart from this. – alexus May 1 '15 at 16:46
  • Thanks. I did and it passes all tests. I still can't load Twitter with Chrome, that shows the previous error and doesn't even allow me to override it. I've tried it with different connections. At home, local pub, hotel, 3G with my phone. It also works with Safari for me. It's a problem just in Chrome. – Osvaldo May 2 '15 at 9:59
  • 1
    Agreed with @Osvaldo. Twitter.com stopped working few weeks ago, and nothing will fix it. Chrome build 42.0.2311.135. Works fine in Safari. – Kingz May 11 '15 at 4:05
  • For me the issue was an expired Comodo certificate. Awkward that you need to start another browser to find out which certificate authority the "unsafe" site is using. Chrome v.57 doesn't give a clue. – Pro Backup Mar 23 '17 at 22:01
2

I had the same problem, just with respect to different sites. It took me some time to go through a number of resources (including

Finally, what worked:

  • check which certificates do not work (click on the lock with red cross, left to https),
  • using Keychain Access, remove this key (is in login, then certificates`),
  • install this certificate (or even a certificate family) from a trusted source.
  • restart Chrome, perhaps, for some sited I had to wait some time (10 min?).

In my case, the problem was with VeriSign Class 3 Primary CA - G5. Then, I downloaded and installed all crt files from https://www.symantec.com/page.jsp?id=roots.

2

I was getting this on Mac OS Sierra on a cert for my company.

I fixed it by:

  • going into Key Chain Access.
  • Find certs for my company
  • *.COMPANYNAME.com.
  • There were two
  • Right click > Get Info
  • Then there are a number of drop down with Trust settings.
  • I changed "When using this certificate" : was set to Custom I changed it to "Always Trust"

This set all the drop downs below it to Always trust.

I opened a company website SOMESITE.MYCOMPANY.com and https error went away.

0

I've seen lots of bad information out there on this.

Commercial sites should be using trusted authorities. If errors are seen when accessing Amazon, for example, something could be wrong.

I've seen other recommendations that turn off all invalid cert warnings. This is something that shouldn't be done if you are a consumer on commercial sites. A developer may do this, however.

Intranet sites inside of companies may issue their own certs. This is when the cert needs to be added as a trusted source.

Here are the steps to add the cert to the key chain and set it to trusted:

  1. Access the site
  2. Click the warning icon (red triangle with exclamation symbol)
  3. You'll see a message stating "Your connection to this site is not secure" along with some explantory text. Under this text, click the "Details" link. This will open Chrome Developer Tools.
  4. Click "View certificate"
  5. Click "Detail" section on pop-up
  6. Scroll down to the section that contains a URI for the domain. It should be in the "Certificate Authority Information Access" section. Click this URI and download the cert.
  7. Double click the cert in the downloads directory. This will open key chain access.
  8. Add the cert to your key chain - you can select login (user) or system (everyone).
  9. Once the cert is added to the key chain, double click it and set it to "Always Trust" in the Trust area.

You'll still see the warning icon in the window, but the speed bump warning you about the cert will now be gone.

The steps seem lengthy, but only take a few minutes at most.

-1

Google changed the way that Chrome handles HTTPS connections to servers that have invalid or out of date SSL certificates, and Chrome will reject the connection with the error you're seeing. I've dug around in Chrome's advanced settings and there isn't an option to allow you to selectively opt to accept the connection, though there are options to add certificate files - I haven't dug deeply enough to find the details about how one would add site certificates so that they are accepted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .