31

Prior to the security update released early April my system was working fine. After that, I'm getting invalid certificates everywhere:

  • iTunes says "iTunes can’t verify the identity of the server “init.itunes.apple.com”." and "iTunes can’t verify the identity of the server “xp.apple.com”." when I open it.
  • Chrome gives me warnings for many https sites (e.g. Google is fine, Twitter isn't).
  • Most importantly I can't connect to the App Store anymore, which I was planning to do to upgrade to Yosemite given that Apple decided to not fix one of the security vulnerabilities for the previous versions.

I checked my certificates in the Keychain Access and I don't see anything wrong with them. I've also tried deleting some files related to certificate caches as I've seen mentioned somewhere else, but it didn't help either.

I'm using OS X 10.9.5 in a MacBook Air, Late 2012.

Update

This problem also applies to some systems updated from OS X 10.10 Yosemite to OS X 10.11.1 (15B42) El Capitan.

Improve this question
3
  • did you try keychain repair ? FYI, I have same hw and sw and update without problems so far.
    – Ruskes
    Commented Apr 12, 2015 at 6:54
  • @Bani Just to be sure: Did you install Mavericks or Security Update 2015-004? You linked a somewhat outdated document which describes the security content of OS X Mavericks v10.9.0.
    – klanomath
    Commented Apr 12, 2015 at 11:17
  • I am sure this will sound dumb... But here goes :) Is this happening to all websites? If it is and you haven't already done this, then check your computer's date and time settings... Just sayin' :)
    – L.B.
    Commented Apr 27, 2015 at 3:48

6 Answers 6

Reset to default
49

The reason:

After installing Security Update 2015-004, multiple users found that they couldn't browse to any website using the root certificate "VeriSign Class 3 Public Primary Certification Authority - G5" without a security warning ("invalid certificate"). 2015-004 updated the list of trusted root CAs, and for a reason I'm still unclear about, many of us have an identical entry in our Login Keychain. The certificate name is the same, but the serial number is wrong. The conflict causes the problem.

The solution:

Open Keychain, and look up your Login Certificates. Export any Verisign certificates (as a backup), and then delete them. Restart your browser.

I had the same issue and asked it in https://security.stackexchange.com/questions/85830/why-is-symantec-verisign-ca-appearing-as-an-invalid-authority .

You can see a full discussion in https://discussions.apple.com/thread/6984765

Improve this answer
6
  • 3
    After security update, i could not see app store, itunes kept giving stupid errors and my browser did not recognize any url with apple.com domain. Of all the answers i checked on different forums, this worked for me perfectly!! Thanks a ton!
    – Pruthvid
    Commented Apr 15, 2015 at 17:10
  • At first I did not associate this issue with the security update, but now that I think about it it probably did start happening around that time. This solution worked perfectly for me. Thank you.
    – ktorn
    Commented Apr 21, 2015 at 11:56
  • 2
    Thank you, this fixed my machine. This bug seems very serious: affected Macs can't get software updates at all. Visiting Apple web sites in Safari shows errors and Chrome won't load them at all.
    – Nelson
    Commented Apr 25, 2015 at 18:09
  • 5
    I figured out it's Cyberduck that is writing the keychain entries that cause the problem. The latest version (4.7) doesn't do this anymore, but old entries still cause problems. Details: nelsonslog.wordpress.com/2015/04/28/…
    – Nelson
    Commented Apr 28, 2015 at 16:08
  • 3
    Had a similar issue after upgrading to El Capitan. This fixed it.
    – webinista
    Commented Oct 11, 2015 at 15:51
1

For some reason my system time was set to about 10 days earlier, likely when my system went into battery very low sleep mode.

My solution was to goto System Preferences | Date & Time, click lock, enter my admin password, and the time then auto-updated to be current and problem solved.

MacBook Pro 15" Late 2008 El Capitan 10.11.6 (15G22010)

Improve this answer
0

Thanks, this seemed the most promising for me..

(Edit: sadly it didn't work for me, but it got me on the right path, so read on... thanks!)

I searched the keychain and did indeed find those verisign G5s .... i deleted them but i still had the same problem with the same/similar error messages you mentioned above, even after a browser and entire mac restart ??? I am at a loss.... it only occurred in the last few days since the update. I cannot connect with the software update in app store any longer as well Before I found this I wiped and restored my mac from an earlier Time Machine backup.... all good.... but obviously after that the update went on again and I am back to the same problem....

UPDATE: i took another look and found some even earlier verisign G3 and G4 certificates similar to the above.... i backed up and then deleted those... tried iTunes again and this time only one of the approximate 9 errors flagged up...... Hmmmm!

I checked again (as I remember reading there was also a possible problem with some Symantec certificates) and took a chance and did the same with those..... now iTunes and app store and software updates are all working

WARNING: I am no expert and had nothing to lose as I had everything backed up... but what i did worked 100% for me... BUT I still do not know if any of these deletions will cause additional, as yet undiscovered problems.... so far so good

(if someone better qualified can confirm this is all OK that would be great)

Hope this helps! :)

Improve this answer
1
  • UPDATE 2 This may also affect long time mac users that have migrated systems from earlier Mac computers over the years.... There are also G3 and G4 certificates that cause problems. Anybody using Microsoft CRM and O365 online systems may notice that in Chrome (Safari seems to remain working) when logging on to those online portals their initial LOGIN is red and unsecured, once logged in however the connection is secured but the initial login user and password was unsecured.... Again, this was resolved when removing the older Verisign certificates.
    – BaC
    Commented Apr 17, 2015 at 10:53
0

I am using Macbook Pro Retina, 15-inch, Late 2013 with MAC OSX 10.9.5 and got the same issue with the following:

  • "iTunes can’t verify the identity of the server “init.itunes.apple.com”."
  • "iTunes can’t verify the identity of the server “xp.apple.com”."
  • App Store login "Connection Failed"

Open Utilities => Keychain Access => search "Verisign" => delete the Verisign login in blue color.

Then relaunch your App Store or iTunes. This should fix it.

Improve this answer
0

To solve "Your connection is not private" issue I went to keychain access, typed verisign in search and deleted them. Clicked keys emblem on left , they were gone, then rebooted chrome. Now it works. Thanks for the help.

I have a MacBook OS X (10.6.8 )

Improve this answer
0

I followed instructions here, deleted all VeriSign certificates, but still got errors on ITunes etc. What worked for me was after doing the above steps, I went into Keychain > Keychain First Aid and repair permissions.

ITunes and other failing certificate errors were fixed!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .