Re-added certificate leads to unknown authority

Question

Messing around with Keychain Access on macOS Sierra, it seems like I have accidentally deleted trusted root certificates in Keychain Access.

What I did was opening a *.p7s file to add a S/MIME certificate. This threw an error:

An error occurred. Unable to import the certificate.
Error: -26276

, but still the certificate ended up being listed in Keychain Access. Next, opening Mail and creating a new Email I was able to use the certificate. I decided to delete the certificate from the Keychain and re-add it in order to resolve the error. Therefore I deleted all entries containing the name of the trusted source I have used for my certificate (I believe). Now adding the same certificate again, still an error appears but the then listed entry says: This certificate was signed by an unknown authority, and Mail doesn't let me use it anymore... I have also created and added a new certificate with the same authority leading to the same result.

Is it even possible I have deleted the default trusted root certificates from inside Keychain Access, or why else can I not use the certificate anymore? Is there a way to reset or fix it?

Answer 1

If you have in fact deleted a trusted root certificate, then you must

1. add it again
2. trust it again

In order to trust the certificate, open it by double-clicking on it in the keychain, open the Trust section, then set When using this certificate: Always trust.

In order to make Mail accept the newly trusted certificate, it may be necessary to quit and re-start Mail.

If all fails, you could re-install your macOS over the existing installation which will most probably restore all pre-installed root certificates again.

Answer 2

THIS IS JUST TEXT TO FULL FILL THE 30 CHARACHTER LIMIT.

Answer 3

#when in doubt, delete#

• Step 1: Deep Breath.

• Step 2: Open Keychain. You should have two sets of tabs, one at top, one at bottom. Select "LOGIN" on top and "CERTIFICATE" on the bottom.

• Step 3: Sort this by last modified. It should be one or two lines, I want you to right click, services > Revoke. If you do not see a function like that in services, then head on over to GPGTOOLS DOT ORG. The forum limits my amount of links, sorry. Download GPG Suite Beta 3, its on the home page. Right click > Services > Revoke them. If you did it through Comodo previously, go to the email and click the revoke button there and enter the password to revoke it.

• Step 4: After revoking, delete them. Right click and delete. It will give you prompts about it. Again, it should only be one or two lines, there may be other line items right above and below that may have your email, don't to those. Do it by Date.

• Step 5: After you delete them from the keychain. Delete the .P7S files in the directory structure where you downloaded them and send them to the trashcan. Ok, everything should be cleared out. Just in case, select "My Certificates" now instead of "Certificates" and make sure you don't see it duplicated there and its officially gone.

• Step 6: Head to COMODO website and start the process here. USE SAFARI on this one, dont use firefox like it says. I have included the link below here. Sign up for the free one, its super easy.

  https://www.comodo.com/home/email-security/free-email-certificate.php

• Step 7: After downloading. Close that GPG software if you have it open. You will still get the error, just keep moving on though. Double click the .PZS file you see there. A screen will come up asking where to put it and will offer a drop box to select. Choose "LOGIN" and click okay.

• Step 8: Open Keychain, if it isnt open after that import. Select the LOGIN keychain and "Certificates" on the bottom and you should see it there in the list. It should have a expander and it will expand with a key below it. Double click the key, not the certificate. If you click the certificate, the wrong dialog box will open.

• Step 9: Now you will see another diologue box come up. Select the "Access Control" Tab at the top. Then click the "+" button and search for "MAIL" and select the program. Close the window, not keychain. Then close APPLE MAIL completely, then reopen it again. Compose a message and you should see the blue lock on the right, make sure the email is the correct one.

-Step 10: If you still don't see the encryption in Apple mail, go back to keychain and click the "login" keychain at the top and "KEY" category at the bottom. There won't be a modified date next to it but check to see if you have the "Key from Secure Comodo Com" in there, one should be private the other shared.

-Step 11: If its not there and still not working, in keychain, select "Certificates" again and right click on the one you just imported. Right click, select, NEW IDENTITY PREFERENCE, and type your email exactly how you have it in mail, select the certificate below that name. Close apple mail, reopen it and it should now work. If it didnt, you missed deleting something.