Prior to the security update released early April my system was working fine. After that, I'm getting invalid certificates everywhere:

  • iTunes says "iTunes can’t verify the identity of the server “init.itunes.apple.com”." and "iTunes can’t verify the identity of the server “xp.apple.com”." when I open it.
  • Chrome gives me warnings for many https sites (e.g. Google is fine, Twitter isn't).
  • Most importantly I can't connect to the App Store anymore, which I was planning to do to upgrade to Yosemite given that Apple decided to not fix one of the security vulnerabilities for the previous versions.

I checked my certificates in the Keychain Access and I don't see anything wrong with them. I've also tried deleting some files related to certificate caches as I've seen mentioned somewhere else, but it didn't help either.

I'm using OS X 10.9.5 in a MacBook Air, Late 2012.

Update

This problem also applies to some systems updated from OS X 10.10 Yosemite to OS X 10.11.1 (15B42) El Capitan.

  • did you try keychain repair ? FYI, I have same hw and sw and update without problems so far. – Buscar웃 Apr 12 '15 at 6:54
  • @Bani Just to be sure: Did you install Mavericks or Security Update 2015-004? You linked a somewhat outdated document which describes the security content of OS X Mavericks v10.9.0. – klanomath Apr 12 '15 at 11:17
  • I am sure this will sound dumb... But here goes :) Is this happening to all websites? If it is and you haven't already done this, then check your computer's date and time settings... Just sayin' :) – L.B. Apr 27 '15 at 3:48
up vote 49 down vote accepted

The reason:

After installing Security Update 2015-004, multiple users found that they couldn't browse to any website using the root certificate "VeriSign Class 3 Public Primary Certification Authority - G5" without a security warning ("invalid certificate"). 2015-004 updated the list of trusted root CAs, and for a reason I'm still unclear about, many of us have an identical entry in our Login Keychain. The certificate name is the same, but the serial number is wrong. The conflict causes the problem.

The solution:

Open Keychain, and look up your Login Certificates. Export any Verisign certificates (as a backup), and then delete them. Restart your browser.

I had the same issue and asked it in https://security.stackexchange.com/questions/85830/why-is-symantec-verisign-ca-appearing-as-an-invalid-authority .

You can see a full discussion in https://discussions.apple.com/thread/6984765

  • 3
    After security update, i could not see app store, itunes kept giving stupid errors and my browser did not recognize any url with apple.com domain. Of all the answers i checked on different forums, this worked for me perfectly!! Thanks a ton! – Pruthvid Apr 15 '15 at 17:10
  • At first I did not associate this issue with the security update, but now that I think about it it probably did start happening around that time. This solution worked perfectly for me. Thank you. – ktorn Apr 21 '15 at 11:56
  • 2
    Thank you, this fixed my machine. This bug seems very serious: affected Macs can't get software updates at all. Visiting Apple web sites in Safari shows errors and Chrome won't load them at all. – Nelson Apr 25 '15 at 18:09
  • 5
    I figured out it's Cyberduck that is writing the keychain entries that cause the problem. The latest version (4.7) doesn't do this anymore, but old entries still cause problems. Details: nelsonslog.wordpress.com/2015/04/28/… – Nelson Apr 28 '15 at 16:08
  • 3
    Had a similar issue after upgrading to El Capitan. This fixed it. – webinista Oct 11 '15 at 15:51

Thanks, this seemed the most promising for me..

(Edit: sadly it didn't work for me, but it got me on the right path, so read on... thanks!)

I searched the keychain and did indeed find those verisign G5s .... i deleted them but i still had the same problem with the same/similar error messages you mentioned above, even after a browser and entire mac restart ??? I am at a loss.... it only occurred in the last few days since the update. I cannot connect with the software update in app store any longer as well Before I found this I wiped and restored my mac from an earlier Time Machine backup.... all good.... but obviously after that the update went on again and I am back to the same problem....

UPDATE: i took another look and found some even earlier verisign G3 and G4 certificates similar to the above.... i backed up and then deleted those... tried iTunes again and this time only one of the approximate 9 errors flagged up...... Hmmmm!

I checked again (as I remember reading there was also a possible problem with some Symantec certificates) and took a chance and did the same with those..... now iTunes and app store and software updates are all working

WARNING: I am no expert and had nothing to lose as I had everything backed up... but what i did worked 100% for me... BUT I still do not know if any of these deletions will cause additional, as yet undiscovered problems.... so far so good

(if someone better qualified can confirm this is all OK that would be great)

Hope this helps! :)

  • UPDATE 2 This may also affect long time mac users that have migrated systems from earlier Mac computers over the years.... There are also G3 and G4 certificates that cause problems. Anybody using Microsoft CRM and O365 online systems may notice that in Chrome (Safari seems to remain working) when logging on to those online portals their initial LOGIN is red and unsecured, once logged in however the connection is secured but the initial login user and password was unsecured.... Again, this was resolved when removing the older Verisign certificates. – BaC Apr 17 '15 at 10:53

I am using Macbook Pro Retina, 15-inch, Late 2013 with MAC OSX 10.9.5 and got the same issue with the following:

  • "iTunes can’t verify the identity of the server “init.itunes.apple.com”."
  • "iTunes can’t verify the identity of the server “xp.apple.com”."
  • App Store login "Connection Failed"

Open Utilities => Keychain Access => search "Verisign" => delete the Verisign login in blue color.

Then relaunch your App Store or iTunes. This should fix it.

To solve "Your connection is not private" issue I went to keychain access, typed verisign in search and deleted them. Clicked keys emblem on left , they were gone, then rebooted chrome. Now it works. Thanks for the help.

I have a MacBook OS X (10.6.8 )

I followed instructions here, deleted all VeriSign certificates, but still got errors on ITunes etc. What worked for me was after doing the above steps, I went into Keychain > Keychain First Aid and repair permissions.

ITunes and other failing certificate errors were fixed!

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.