5

I'm running El Capitan (macOS 10.11.6, 15G22010) with Safari 11.1.2.

The ADDTrust External CA Root certificate expired today. This broke Safari navigation for many sites. Firefox and Chrome work fine on the same sites.

Can Safari navigation be fixed?

Improve this question
  • 1
    There was a recent Safari update, did you apply it? – Steve Chambers May 30 '20 at 20:48
  • 1
    @SteveChambers, not available for this system. The last Safari is the one I'm using. – lhf May 30 '20 at 21:21
  • This seems to be relevant but I don't understand it enough: security.stackexchange.com/questions/232445/… – lhf Jun 2 '20 at 0:07
  • Does adding a new root CA to Keychain Access and setting "Secure Socket Layer" to "Always Trust" not work? I'd expect it to! – Wowfunhappy Nov 2 '20 at 19:26
1

An insecure method to work around the certificate expiration is to tell your macOS to Always Trust this certificate.

When loading the site in Safari and seeing the "Safari can't verify the identity..." click Show Certificate, select the "Comodo RSA Certification Authority", then check the box that says "Always trust this certificate".

To reverse this, you should see a new entry in Keychain Access.app in the login keychain that shows this certificate as Always Trusted, which you can change back to "Use System Defaults".

Note that blindly accepting an expired certificate is a risky proposition, and use at your own risk. (Say, if this Certificate Authority were compromised and revoked, Safari could show malicious sites as Secure. Rare, but has happened in the past.)

I've not yet found a way to install an updated AddTrust/Comodo Root CA that solves this issue.

Improve this answer
  • Yes, I've been doing something like this, thanks. – lhf Jun 5 '20 at 0:32
1

Same issue here; a temporary (not production-ready) fix is to set back your system date.

Improve this answer
  • Good to know but very inconvenient. – lhf May 31 '20 at 11:13
1

I had same issue (same macOS/Safari versions).

I solved it for myself by installing USERTrust RSA Certification Authority SHA-2 root certificate from Sectigo website. It is in a knowledge base article called How to Download & Install Sectigo Intermediate Certificates - RSA.

Go to Sectigo website -> Support -> Knowledge Base, and it is the most viewed article as of this writing. The SHA-2 root certificate is towards the bottom of the article (just above the expired one).

After downloading, I opened the certificate in Keychain Access. It is untrusted by default, so I did right-click -> Get Info on the certificate, expanded the Trust part and chose When using this certificate: always trust. You need a macOS admin password to make the change. When I did it first time, my computer became unresponsive... (old 2008 MacBook), but after a reboot I could repeat the change and it went without a hitch.

I'm not a certificate expert so I don't promise it is the "right kind" of workaround, or it works for all websites. I just tried the one website which was failing me before, and I saw Safari is now using the newly installed SHA-2 root certificate for it.

Hope that helps.

Cheers.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .