Fix Untrusted Cert Title Error on macOS

If you see an “Untrusted Cert” or “Certificate Not Trusted” error in macOS—often in Mail, Safari, or when connecting to a server—it means the system doesn’t recognize the certificate’s signer. This guide walks you through the exact steps to inspect the certificate, adjust its trust settings, and clear the stale cache that causes the error to persist.

What You’ll Need

Administrator access to your Mac (you’ll be prompted for your password).
The URL or hostname that’s triggering the error.
If the certificate is self-signed or from a private/internal CA, you’ll need the certificate file (often a .cer or .pem) or the ability to export it from the server.

Step-by-Step

Identify the exact error. Note the full message and the hostname. For example, “Safari can’t verify the identity of the website” or “The certificate for this server is invalid.” This tells you whether it’s a trust issue or an expiration issue.
Open Keychain Access. Go to Applications > Utilities > Keychain Access, or use Spotlight (Cmd+Space) and type “Keychain Access”.
Find the certificate. In the search box (top-right), type the hostname or the name of the certificate issuer. Certificates are usually stored in the “login” or “System” keychain. If you don’t see it, try “System Roots”.
Inspect the certificate. Double-click the certificate to open its details. Check the “Trust” section (you may need to expand it). Look at the “Validity” dates—if it’s expired, you’ll need to renew it.
Set trust to “Always Trust”. For a certificate you know is valid (e.g., a self-signed cert for your own server), expand the “Trust” section and change “When using this certificate” to Always Trust. For SSL/TLS, also set “Secure Sockets Layer (SSL)” to Always Trust.
Enter your password. After changing trust settings, you’ll be asked for your Mac’s password. Enter it to save the changes.
Clear the certificate cache. Open Terminal (in Utilities). Run the following command to clear the system’s certificate cache:
sudo killall -HUP configd
This forces the system to reload its network configuration and certificate trust settings.
Restart the app. Quit and reopen the app that showed the error (e.g., Safari, Mail). If it still persists, restart your Mac.
If the certificate is not in Keychain Access: It may be a server-side issue. Contact the server administrator to ensure the certificate is properly installed and includes the full chain (intermediate certificates).
For a self-signed certificate: You can also manually add it to the “System” keychain via File > Import Items, then set trust to “Always Trust”.

Common Mistakes

Changing trust on the wrong certificate. Make sure you’re editing the certificate for the hostname you’re connecting to, not a similarly named one.
Setting trust to “Always Trust” for a public certificate. That can be a security risk. Only do this for certificates you control or explicitly trust.
Forgetting to clear the cache. Even after changing trust, the old error may persist until you run the killall -HUP configd command or restart.
Editing the login keychain instead of System. For system-wide trust, you need to modify the certificate in the System keychain, not just your login keychain.

Tips

Always verify the certificate’s fingerprint with the server administrator before trusting it, especially for internal services.
If you’re using a corporate or school Mac, check if your organization has a profile that manages trust settings. Changing them manually may be overridden.
Use the “Get Info” window in Keychain Access to see the certificate’s full chain. If an intermediate certificate is missing, you’ll need to install it.
For testing, you can temporarily trust a certificate, but remember to revert it after troubleshooting.

Troubleshooting

Error still appears after setting “Always Trust”. Make sure you changed the trust for the correct certificate in the System keychain. Also, try restarting your Mac completely.
Certificate not found in Keychain Access. The certificate might be stored in a different keychain (e.g., “System Roots”). Search in all keychains by selecting “All Items” from the left sidebar.
You see “This certificate has an invalid issuer”. This usually means the intermediate certificate is missing. Obtain the full chain from the server admin and install it.
Mail app still shows the error. Mail caches connections. Go to Mail > Preferences > Accounts, remove the account, and re-add it. Or use the “Window > Connection Doctor” to see the exact error.
After clearing cache, Wi-Fi stops working. Rare, but if that happens, restart your Mac or reset the network settings via System Settings > Network.

Frequently Asked Questions

What does “Untrusted Cert” mean?

It means macOS does not recognize the certificate’s issuer as a trusted certificate authority (CA). This can happen with self-signed certs, expired certs, or missing intermediate certs.

Is it safe to trust a certificate manually?

Only if you are certain the certificate is legitimate. For self-signed certs on your own servers, it’s fine. For public websites, it’s better to fix the server-side issue.

Why does the error keep coming back after I trust it?

You might have edited the login keychain instead of System, or the certificate’s chain is incomplete. Also, some apps (like Chrome) use their own trust store—check the browser’s settings.

Can I bypass the error temporarily?

In Safari, you can click “Show Details” then “Visit this website” to proceed, but that only works for the current session. In Mail, you can click “Connect” to accept the certificate temporarily.

How do I export a certificate from a server?

Use a browser to visit the server, click the padlock icon, and drag the certificate icon to your desktop. Then import it into Keychain Access.

Will this fix work for all apps?

Most apps use the system trust store, but some (like Firefox) have their own. For Firefox, you need to import the certificate into its own settings.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →