# macOS + Safari certificate weirdness **URL:** \ **Category:** Help\ **Created:** [April 7, 2020, 11:46pm UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778 "2020-04-07T23:46:08Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jen729w](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jen729w](https://community.letsencrypt.org/u/jen729w)\ **Post date:** [April 7, 2020, 11:46pm UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/1 "2020-04-07T23:46:08Z")
This isn’t _directly_ a Let’s Encrypt issue, but I’m hoping this audience can help me resolve it as it’s obviously deeply related to SSL certificates. (If this is deemed too off-topic, please accept my apologies and let me know.) On macOS (10.14.6), using Safari (13.1), Safari is telling me that it “can’t establish a secure connection to the server”. But only sometimes: - The majority of sites work fine. - It works fine after a reboot. - Last time it went 27 hours after the reboot before re-occurring. ¯\_(ツ)\_/¯ It’s weirder than that: - OmniFocus, which establishes an SSL connection to [https://sync3.omnigroup.com](https://sync3.omnigroup.com), also fails. - Plenty of other sync services on my Mac do not fail. OF must be using the system certificates? - _Some_ sites which use the **Let’s Encrypt Authority X3** certificate keep working (e.g. [https://coruscade.com](https://coruscade.com)). - _Other_ sites which use the same certificate chain fail (e.g. [https://bum-man.com.au](https://bum-man.com.au)). - That last site is actually hosted at [https://bumman2020.netlify.com](https://bumman2020.netlify.com). When accessed via that URL, the certificate is **DigiCert SHA2 Secure Server CA** and works A-OK. - Firefox always works. So how does its certificate behaviour differ from Safari? Does it manage its own, and not use the system keychain? - Brave fails but in a really weird way. It tells me that the cert is invalid (`NET::ERR_CERT_INVALID`) but when I inspect the certificates they’re all valid! Here’s an example of that, using another certificate that fails. ([https://theage.com.au](https://theage.com.au) is a large newspaper – this site works fine in Firefox.) ![](https://global.discourse-cdn.com/letsencrypt/original/3X/e/1/e12c0da68fc038259bc1d69e6743749723a01e0b.jpeg) - When this issue occurs, it’s always the same certificates that fail. Repeatable, predictable. - I have re-created my keychain. Made no difference – I assume that just deleted my personal stuff but didn’t touch the system root certificates? I have a question open [on StackExchange](https://apple.stackexchange.com/questions/387254/safari-cant-establish-a-secure-connection-and-omnifocus-sync-is-broken?noredirect=1#comment528635_387254) which has some more detail. This is driving me bananas. Please someone here tell me how macOS certificate management works, and help me fix this. Thank you. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [April 8, 2020, 12:09am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/2 "2020-04-08T00:09:31Z")
> [@jen729w](#): > > Does it manage its own, and not use the system keychain Yes, I think Firefox uses its own root store unless you configure it not to. > [@jen729w](#): > > Brave fails but in a really weird way. It tells me that the cert is invalid ( `NET::ERR_CERT_INVALID` ) ☹ `ERR_CERT_INVALID` is a catch-all, I think. Usually the error code is more specific, and you can click on the error code for more information about the certificate. But I don't think it'll help in this case. I don't have a solution for you other than to tell you that my sister experienced a similar thing on macOS some weeks ago. Except hers also had problems with some certificates from Amazon CA, until she rebooted her laptop. e: One idea - on that screenshot, you are showing that the leaf certificate is valid. If you select the intermediate, or the root, do they also have the same "This certificate is valid" text? ---
**Author:** ![jen729w](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jen729w](https://community.letsencrypt.org/u/jen729w)\ **Post date:** [April 8, 2020, 12:22am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/3 "2020-04-08T00:22:10Z")
Thanks, I’ll go digging around in Firefox and see if I can come up with anything interesting. Yeah, Brave reports all 3 certificates in that screenshot as valid. Told you this was weird! ---
**Author:** ![jen729w](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jen729w](https://community.letsencrypt.org/u/jen729w)\ **Post date:** [April 8, 2020, 3:20am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/4 "2020-04-08T03:20:26Z")
Stranger still: if I open a private window in Safari and browse to one of the broken sites, Safari warns me that “this connection is not private” and gives me the chance to “visit this website” as long as I authenticate to confirm that it is safe to do so. When in a non-private window, I am not given this option. It’s just a flat-out “can’t establish a secure connection”. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [April 8, 2020, 4:05am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/5 "2020-04-08T04:05:36Z")
> [@jen729w](#): > > When in a non-private window, I am not given this option If you're referring to your bumman site, it'd be because it's setup with an [HSTS header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security). Browsers will omit the option to bypass the warning screen for HSTS-protected sites (that it's seen before, or are in the HSTS preload list). When you browse the site in private mode, the HSTS cache isn't used, so the browser lets you through. Don't think it explains your issue, though. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [April 8, 2020, 5:11am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/6 "2020-04-08T05:11:15Z")
This recent thread is similar: > [@Letsencrypt.org frontpage "NET::ERR\_CERT\_INVALID"](https://community.letsencrypt.org/t/letsencrypt-org-frontpage-net-err-cert-invalid/116707): > > H… In that thread, the issue _seemed_ to be that macOS didn't recognize a newer Certificate Transparency log that should have been supported since early December. The OP said yesterday that it was fixed after installing a recent update. ---
**Author:** ![jockek](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jockek/32/9020_2.png) [@jockek](https://community.letsencrypt.org/u/jockek)\ **Post date:** [April 8, 2020, 7:08am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/7 "2020-04-08T07:08:25Z")
If it works for OP after a reboot, it might be what made it “work” for me after applying the the update (since it rebooted). I’ll have to wait and see, I guess. OP, you say all updates are installed, does that also imply the 002 security update from end of March? ---
**Author:** ![jockek](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jockek/32/9020_2.png) [@jockek](https://community.letsencrypt.org/u/jockek)\ **Post date:** [April 8, 2020, 7:14am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/8 "2020-04-08T07:14:58Z")
OK, the issue is back on my Mac now, so it seems we have the same issue, and that it’s solved temporarily by rebooting. The latest security update ([https://support.apple.com/en-gb/HT211100](https://support.apple.com/en-gb/HT211100)) did not solve it. @jen729w, are you by any chance using Little Snitch? ---
**Author:** ![jen729w](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jen729w](https://community.letsencrypt.org/u/jen729w)\ **Post date:** [April 8, 2020, 7:44am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/9 "2020-04-08T07:44:48Z")
@jockek Sibling! You have it too. I’m not alone. I do use Little Snitch, yes. Always have, config hasn’t changed in however long. These servers ping just fine and I’ve tried this with the network filter off, no change. I recall a recent security update, yes. They pop up I do them as soon as I see them. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [April 8, 2020, 7:57am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/10 "2020-04-08T07:57:44Z")
Have you and @jockek tried to see if those websites work in safe mode? (e.g. disabled all extensions and other potential softwares). Other networks? Have you submit any reports to Apple Support? ---
**Author:** ![jen729w](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jen729w](https://community.letsencrypt.org/u/jen729w)\ **Post date:** [April 9, 2020, 1:29am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/11 "2020-04-09T01:29:18Z")
The problem with safe mode is that the issue is fine immediately after a reboot. I’d need to operate in safe mode for ~24h until it occurs, which I can’t afford to do. This is my main work machine. I have tried other networks, yes. The network is not the issue. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 9, 2020, 1:32am UTC](https://community.letsencrypt.org/t/macos-safari-certificate-weirdness/118778/12 "2020-05-09T01:32:06Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.