1

I don't have enough rep to comment on this question which would probably be more appropriate than asking a new question: How do you remove SSL certificate exceptions on OS X?

I just tried this on OSX 10.12.5 with Safari 10.1.1 and it's not a solution for me. I can't find the exception'ed certificate anywhere to delete or change it's permissions. I've also chosen to show invisble items and expired items in the keychain and closed/reopened Safari.

Personally I think the browser itself should include an option to revoke the exception instead of jumping through the OS, if it makes it so easy to set it, it should be just as easy to remove it from the same place like other modern browsers allow for.

Back story: I visited a website I recently created and added the Cloudflare Universal Edge certificate however my domain is actually serving up my server's CloudFlare Origin certificate which is untrusted and should only be used for traffic between my server and Cloudflare. I know this is NOT an OSx or Safari issue however...

In Safari, I accepted the exception because 1) I know my website is completely safe and 2) I needed to access it right away while CF helps me figure out the problem is of the wrong cert being provided.

However I need to remove this exception so I can test my site's SSL properly ensuring it's fixed. I'm forced to use another machine.

The problem is the recently added exception is not listed anywhere in keychain access. So what do I do? I'm a web developer and if this is giving me this much headache how does Apple expect non technical folks to handle this?

Improve this question
2
  • I'd try isolating the issue with different browsers. Try chrome, it uses the system keychain as well. If it doesn't alert you to the exception, you know it's in you keychain—use the search box to narrow down possible candidates. Try Firefox, it handles exceptions internally. If Firefox doesn't alert you to the exception then you know the problem lies elsewhere.
    – sansSpoon
    Aug 9, 2017 at 23:35
  • I mention already in my op that other browsers are a non-issue. The issue remains, the exception chosen from within Safari is not easy to revoke because it's not "within" Safari as other browsers allow for like as you suggested Chrome and Firefox. Additionally my issue was the exception NOT showing up in the Os's keychain...at least until I rebooted, then it showed up.
    – Philip Ingram
    Sep 23, 2017 at 19:10

2 Answers 2

Reset to default
0

I had this issue come up recently when traveling out of town, and having issues connecting to hotel WiFi, and in doing so did some IP sniffing, and trying to get onto a site via IP, which had a certificate mismatch, which I first added an exception to.

To get to the bottom of it, I first got info from the certificate in the browser, but nothing turned up in Keychain access looking for that. What I did to fix this was click on the lock icon in the URL bar, then clicked on Show Certificate. In that window, go to Trust > When using this certificate, and click on the ? icon to the right of the settings, which brings up a Mac Help window, which if you click on the link Open Keychain Access for me, where you can see the certificate highlighted in the Keychain Access listing. Tap the info button on the bottom of the screen, and from that window click to expand Trust, then change When using this certificate to Use System Defaults. Once this is done, flush your caches, close and restart the browser, and test to confirm.

Here's a screen capture with that first info button highlighted:

enter image description here

Improve this answer
1
  • Thx @karolus - I would think rep would not come into play when upvoting on one's own posted question but I suppose I'm not good enough (yet) to do that. Anyway, this was great info and I will try this next time I run into this problem. Needless to say, the way Safari handles this particular task could be improved upon.
    – Philip Ingram
    Sep 23, 2017 at 19:12
3

At least on my Catalina machine, I've found that the bypassed-invalid-cert-warning list is kept in:

~/Library/Containers/com.apple.Safari/Data/Library/Safari/BypassedInvalidCertificateWarning.plist

Modifying or deleting that file (and, as needed, emptying Safari's caches) is sufficient to get the invalid cert warning back again.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .