Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Safari and Chrome report invalid certificates on certain HTTPS sites (for example GitHub and Bitbucket). Firefox strangely shows a green valid certificate.

I've created a new OS X user and everything is perfectly valid there. I though that maybe there was some invalid certificate in my login keychain. However, even after removing all certs from that keychain, it still reports as invalid.

The Entrust cert that only shows on my account is present in my login keychain. I removed it, which makes the DigiCert High Assurance EV Root CA the new top certificate in the list, but it is not the same cert as on the working account...

The problem also occurs when using curl or for example pushing with git.

Is there something I'm overlooking?

UPDATE
Everything works after copying the DigiCert High Assurance EV Root CA from the System Roots to the login keychain. But why is this necessary on my user account?

Certificate chain in Safari on my user account Certificate chain in Safari on my user account

Certificate chain in Safari on a new OS X account Certificate chain in Safari on a new OS X account

share|improve this question
    
Is the computer fully up to date with all software patches and updates on the latest version of OSX? –  Darth Android Jul 25 at 16:01
    
Yep, installed all the updates. It feels like somehow Safari is using an old certificate or something. –  Rengers Jul 25 at 16:03
1  
When using the search box in Keychain Access to find "digicert high", do you get a single hit? (On my Mac, I only get the one that expires November 2013, and that's in the System Roots.) –  Arjan Jul 25 at 16:22
    
Yes, I only get one certificate that expires 10 november 2031. This cert is in my System Roots. The weird this is: after I copy this to my login keychain (so that I have it twice), it actually works! But why doesn't it pick it up in the System Roots keychain...? –  Rengers Jul 25 at 16:24
1  
I just noticed that my Keychain Access did not show any expired root certificates. Enabling that in menu View, Show Expired Certificates might show you another version when searching for "digicert high"? (No changes for me, for that search.) –  Arjan Jul 25 at 16:42

3 Answers 3

up vote 4 down vote accepted

It seems that somehow Chrome and Safari for that account are using an expired root certificate, even though a new one is already present in your System Roots.

However, by default Keychain Access does not show expired certificates: enable that using menu View, Show Expired Certificates, and then search for the name of the expired certificate, like "digicert high". Then delete any expired one. As all is fine in a new user account, the culprit must be in your Login Keychain.

(This doesn't explain why Firefox uses the correct one; I would expect all browsers to simply delegate the full validation to OS X, but apparently not.)

share|improve this answer
    
Something to keep in mind: some say that using synchronization through iCloud might actually restore the expired certificate again. –  Arjan Jul 28 at 20:44
    
One final step: restart your browser after deleting any expired certs. @Arjan thanks for the tip! –  schmielson Jul 30 at 22:23

I had the same problem with my macbook pro and sourcetree app. I followed the instruction provided in the digicert blog (link provided below) to solve this issue.

https://blog.digicert.com/expired-intermediate-certificate/

share|improve this answer
    
Hah, nice. The exact solution, only posted a day after my question 😄. –  Rengers Jul 28 at 18:46

I'm not 100% sure about the solution.

But same thing happened to me when I set a back date on my PC. Suppose this is 2014. If you set 2013 or 2012 as your year, this problem may happen.

And in this situation, it's really tough to sign in Gmail, Facebook or Yahoo!

Check your date settings.

Thanks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.