4

Trying to pull from a git repository I got an "SSL certificate problem: Invalid certificate chain", and was unable to access.

The answer here: git SSL certificate- Invalid certificate chain while accessing says it's an expired certificate problem.

When I visit the repository with Safari I get a message that a certificate issued by TERENA SSL CA has expired. However, I cannot find this certificate in my keychain. The keychain only contains a new, updated certificate from TERENA.

I have enabled "Show expired certificates" in the View menu, and I can see other expired certificates, but not the one from TERENA.

How can I find and delete this certificate?

Edit: The referenced answer in the comment below does not answer my question. The problem is that I cannot locate the expired certificate.

Improve this question
2
  • Possible duplicate of How do I fix the SSL warning I get when visiting github.com?
    – Allan
    Aug 11, 2016 at 11:07
  • Is it possible that a certificate you use, that hasn't expired, is somehow signed by an expired certificate from TERENA that hasn't been added to Keychain Access (or deleted in the past)? I have been able to delete intermediate or root keys used to sign my personal certs without deleting the personal certs. Unfortunately I can't see a straightforward way to view this info in Keychain Access without evaluating certificates one by one.
    – dunxd
    Jan 14, 2019 at 13:56

1 Answer 1

Reset to default
2

The procedure to locate an expired certificate in a specific keychain is covered well in this answer:

Be sure that you look on the left of the Keychain Access window - you should have a login keychain, maybe an iCloud keychain, a system Keychain and System Roots.

If you don't find the expired certificate in the first keychain, repeat the process after selecting each other keychain. Also pay attention in case you are not selecting All Items or Certificates in the filter under the list of Keychains.

enter image description here

Improve this answer
4
  • I am familiar with the correct way to solve the problem. Unfortunately, my problem remains unsolved: even after looking in every keychain, and selecting "All items" I can still not find the expired certificate, and consequently I cannot delete it.
    – DNF
    Aug 11, 2016 at 17:30
  • @DNF Forgive me for guessing then. I could only make this guess as a sticking point - I'm not sure what your recourse would be to do other than reinstall the OS at this point. Repairing the keychain doesn't seem like it would help and if there's no expired certificate in the keychain - Safari really shouldn't be consulting any other stores for keys.
    – bmike ♦
    Aug 11, 2016 at 21:58
  • I hope I didn't come across as annoyed. Your answer showed me how to better search for certificates. I found a lot of stuff I didn't find at first, but unfortunately not the certificate I was looking for. Reinstalling the OS seems drastic, so I'll hold off for a while to see if any other suggestions come up.
    – DNF
    Aug 12, 2016 at 6:56
  • No worries at all :) my vote is +1 on your question and I'm hoping other suggestions are offered. I agree reinstall is drastic. Maybe you might install on a USB drive to test rather than changing the boot drive
    – bmike ♦
    Aug 12, 2016 at 6:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .