Cannot find duplicate root CA for development Safari claims to have

Question

Created Mar ’24

Replies 2

Boosts 0

Participants 2

I use three Macs for development of a web application. On each of the Macs (macOS 14.4) I used mkcert to install a local CA and to issue developer certificates (all separately). Accessing the web app with https://localhost:8080 works fine on two Macs with all browsers, but on one Mac Safari claims to have another root CA for localhost which it does not trust. And I cannot override the trust settings.

Using Keychain Access I do not find this certificate. Safari shows it like this:

Bildschirmfoto 2024-03-14 um 13.07.38.png

Scrolling down I can see DNS Names localhost, localhost.localdomain and lvl.me, so I suspect it is a leftover from trying to install a root CA before using mkcert.

The mkcert certificate looks like this and I can see it in the System keychain:

Bildschirmfoto 2024-03-14 um 13.08.04.png

So Safari complains and I cannot tell it to trust the server certificate as the CA does not fit (I think). Firefox and Chrome open the website just fine after warning me and me telling them to do so.

I tried to find the wrong CA using Keychain Access and Terminal (security find-certificate -a -c localhost, security find-certificate -a -c lvh...) but in vain.

Where can I find this certificate and how can I delete it?

Boost

Answer 1

Lumpy Gravy OP

May ’24

The strange certificate came from a settings error I made in the configuration file of the framework I use (Quasar). I got the https configuration for the development server wrong and Quasar issued an ad-hoc certificate instead of using the certificate I provided.

So my question boils down to why Safari won't let me accept the certificate on one of the Macs.

But maybe an even better solution for that last problem: I added the mkcert root CA and the certificate I signed with this CA to my keychain, now Safari accepts https connections to localhost.

0

Answer 2

DTS Engineer OP

Apple

May ’24

I don’t have any answers to your direct question, but I have some recommendations for how to avoid problems like this:

Rather than working directly with a self-signed certificate, instead create a CA and have it issue certificates. You can then install the CA’s root certificate, and trust evaluation follows a well-trodden path.
Rather than issuing certificates for localhost, issue them for your Mac’s local DNS name. For example, if your Mac is called Guy Smiley it’s local DNS name will be guy-smiley.local. Again, that keeps you on a well-trodden path.

I discuss the specific steps involved in:

Technote 2326 Creating Certificates for TLS Testing
QA1948 HTTPS and Test Servers

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0