Safari can’t establish a secure connection to the server

Question

I realize there is another question with the same title, but my situation is very different.

• The problem started on three of my computers after upgrading from Leopard to Snow Leopard.

• I can login to gmail and facebook using https with no problem.

• I can not login to https://identi.ca/main/login or https://seminars.wolfram.com/ or https://panopticlick.eff.org with Safari, works fine with Firefox.

• Already tried "Safari Reset..."

Any ideas?

Solution 1

I have just solved this problem by following this procedure published by phurd99 in the Apple Support Forums:

1. Open applications
2. Utiliities
3. Open Keychain
4. Click Keychain Access and select Preferences.
5. Click the "Reset My Default Keychain"

(...)

http://discussions.apple.com/thread.jspa?threadID=2138178&start=15&tstart=0

This solves the problem but you are left without you precious keychain (a backup is saved).

Then, using the backup and trial and error I discovered that by deleting one specific certificate, the problem is solved:

UNT-USERFirst-Hardware
Intermediate certificate authority
Note: This certificate is signed by an untrusted issuer

Solution 2

I had this problem as well. Adding new root authority certificates from Thawte fixed the problem. Apple has documentation on how to do this here http://docs.info.apple.com/article.h...en/mh2046.html

I added the root and server certificates that I downloaded from here http://www.thawte.com/roots

Comments

[gdelfino]

Using Firefox, I have just discovered that both problematic sites use certificates issued by Comodo

[Arjan]

Related: Why won't OS X trust GitHub's SSL certificate? and HTTPS certificates invalid on Safari, Chrome on specific user account.

[gdelfino]

Thanks. Did you have to go through all the 8 directories and 14 subrectories double clicking on every .cer and .pem file? Did you add them to your login keychain or to the system keychain?

[gdelfino]

There are dozens of certificates in that download. Which one do I need?