Make Safari on macOS reject insecure connections again

Question

Summary:

I had opened an insecure website in Safari on macOS, which is now displayed with the "Not Secure" warning in the address field. I would like to “reset“ Safari so that this (and other) insecure websites are blocked again.

Details:

• I had opened a website in Safari, which apparently uses an deprecated TLS protocol.
• Safari displayed a warning (reproduced here from a different computer):

• I decided to take the risk and clicked on “visit this website.”

• As expected, the website is displayed, with a red warning “Not Secure” in the address field.

• Now I would like to make Safari reject this (and other) insecure websites again.

Things I tried:

• Remove all website data in Safari, restart Safari, restart the computer.
• Opened the Keychain Access app and searched for a certificate which might have been added as trusted, but found none relate to this website.
• Search for “disable TLS” on this site, which only lead to Disable TLS 1.0 and TLS 1.1 on Safari, which does not solve my problem.
• Search for “safari disable tls 1.1” in the Internet, which lead to this and similar pages, which do not solve my problem either.

Configuration: Safari 15.3 on macOS Big Sur 11.6.3.

Answer 1

Finally I could solve the problem. Clicking on “visit this website” in the Safari TLS security alert stores an exception for that host in the Safari preferences. Apparently, this exception is not removed

• by a restart of Safari,
• by Safari -> Preferences -> Privacy -> Manage Website Data…-> Remove All,
• by restarting the computer,
• after some time.

However, the exception entry can be removed from the preferences file, for example with the PlistBuddy tool from the command line.

The full path to the Safari preferences file is

/Users/<userName>/Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist

The preference key is “allowedLegacyTLSHosts” and the value is a dictionary, mapping host names to dates.

First open a Terminal window, make sure that the current working directory is the home directory, and call PlistBuddy with the "Print" command:

% cd 
% /usr/libexec/PlistBuddy Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist -c "Print :allowedLegacyTLSHosts:"
Dict {
    unsafe.host.net = Fri Feb 11 21:06:06 CET 2022
}

To remove the exception for “unsafe.host.net”, quit Safari and call PlistBuddy with the "Delete" command:

% cd 
% /usr/libexec/PlistBuddy Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist -c "Delete :allowedLegacyTLSHosts:unsafe.host.net"

Check that the entry has been removed:

% cd 
% /usr/libexec/PlistBuddy Library/Containers/com.apple.Safari/Data/Library/Preferences/com.apple.Safari.plist -c "Print :allowedLegacyTLSHosts:"
Dict {
}

Now opening that page in Safari produces the “This Connection Is Not Private” alert again.

Remarks:

• I had updated my computer to macOS Monterey (12.2.1) in the meantime, therefore I do not know if this approach works in previous releases.

• Other/simpler solutions, perhaps without the need to execute complicated commands in the Terminal, are still welcome.