2

I am having trouble with a specific financial services provider; every time I try to visit myvisaaccount.com to check my card balance etc, I get the dreaded Chrome red strikethrough https and x-ed out padlock, with dire warnings about an insecure connection. If I try Safari or Firefox I get different visuals but the same message: invalid security certificate.

However, tech support for VISA does not see this problem from their own home or office computers.

So I am trying to find out why my OSX Lion laptop hates this web site so much. I have got into the Keychain Access tool and I have no personal certificates: empty list. System (and Root) Certificates are all up to date, with no anomalous descriptive text. And yes, my system date/time is correct and I am in the right time zone, and I am getting my date/time from Apple N America timeserver.

[Screenshot of failing certificate]

I am thoroughly out of ideas and very frustrated with this problem. What more can I do to diagnose or fix it?

Improve this question
4
  • Please open the website in Safari, click on the padlock icon, click on "Show Certificate" and take a screenshot of the panel. You should get something like this: i.stack.imgur.com/WW4iW.png. Then add it to your question.
    – Alistair McMillan
    Dec 28, 2015 at 21:10
  • OK, got screenshot. [Error Message] (imgur.com/VMTUVAD ScreenShot)
    – De Clarke
    Dec 29, 2015 at 1:31
  • Sorry, unfamiliar with mini-markdown, but at least the link works. as you can see I get "untrusted issuer" whereas you got success. I don't know enough about how certification works to interpret these results...
    – De Clarke
    Dec 29, 2015 at 1:35
  • For a reason it will be nearly impossible to diagnose your certificate for "Entrust Root Certification Authority - G2" is an outdated one. Most probably something went wrong with one of your MacOS X update and the next ones didn't fix it, because they are always sure they do everything right (which is wrong :( ).
    – dan
    Dec 29, 2015 at 7:59

1 Answer 1

Reset to default
1

Too much to post in a comment so I posted as an answer.

The reason that you are being told the certificate for https://www.myvisaaccount.com/ is not safe is that the root certificate that has been used to sign the www.myvisaaccount.com certificate is not valid on your system.

If you open the Keychain Access application and enter "Entrust" in the search box you should be present with something like seven certificates. Check the expiry date on the one titled "Entrust Root Certification Authority - G2". My guess is that it will have expired.

Screenshot of Keychain Access with Entrust certificates

If the certificate has expired (or does not exist at all), a potential fix for this is to just download and install a new "Entrust Root Certification Authority - G2" certificate. You can find the certificate on Entrust's website here. Just click the "Download" button under the G2 part of that page, this will download a "entrust_g2_ca.er" file to your Mac. Open that and it should automatically open the KeyChain Access application. By default it will likely offer to install to your "login" keychain, change that to add it to your "System" keychain.

It looks like you'll need to install the L1K certificate as well. Install both and then the certificate for the www.myvisaaccount.com should be validated as trusted.

Improve this answer
10
  • OK, here's another screenshot of the Keychain Access utility.
    – De Clarke
    Dec 29, 2015 at 5:03
  • [link](imgur.com/2yhuJEw Keychain)
    – De Clarke
    Dec 29, 2015 at 5:03
  • Observe that there is no "G2" in the descriptive name of any of these "system roots" certificates, and that they are all well inside their expiry window. Looks like I am missing a certificate of type G2? how would I go about getting one? I am running Lion 10.7.5 (fully patched afaik). This problem started when I was still running 10.6.8, and has persisted across the osx update.
    – De Clarke
    Dec 29, 2015 at 5:06
  • 2
    @DeClarke There's no such thing as a "fully patched" Lion installation. Apple stopped patching newly discovered Lion vulnerabilities years ago. If you're at all concerned about security, you need to upgrade to Yosemite or El Capitan, upgrading your hardware if necessary.
    – Mike Scott
    Dec 29, 2015 at 7:45
  • 1
    Well, I'm trusting Alistair here :-) when I visited Entrust's website, I got the same type of warning! However, I proceeded "dangerously," took a sniff around the site, and DL'd the recommended certificate files. I now see the happy green padlock and a clean https connection to myvisaaccount.com. Problem solved! And many thanks to Alistair McMillan.
    – De Clarke
    Dec 29, 2015 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .