Certificates

When you open an https:// address, the server sends a certificate: a signed statement that it really is that site. Your Mac checks it before anything else is exchanged. If the check fails, the browser warns that the connection isn’t private.

The chain of trust

Nobody can check every site personally, so trust is passed down:

• Root certificates belong to a few dozen certificate authorities (CAs). macOS ships with them built in and trusts them.
• The roots sign intermediate certificates, which do the day-to-day signing.
• An intermediate signs the site’s own leaf certificate.

The server should send its leaf and its intermediates. Your Mac follows the signatures up to a root it trusts. SSL Certificate shows the chain it sent.

What a certificate says

• Subject Alt Names: the names it’s valid for, such as example.com and www.example.com. Another name is a mismatch, even on the same server.
• Validity: when it starts and expires. Certificates are short-lived now, often 90 days or less, and renewed automatically. When renewal breaks, the site fails on the day it expires.
• Issuer: who signed it.

When it isn’t trusted

• Expired, or not valid yet. Also check the Mac’s clock.
• Name mismatch: the certificate is for another name.
• Incomplete chain: the server didn’t send its intermediate. Browsers often fetch it themselves, so the site works in Safari and fails in other apps.
• Self-signed: signed by itself, not by a CA. Normal on routers, printers and NAS boxes. Trust it only if you know where it came from.

Related

• SSL Certificate.
• Uptime Monitor can warn you before a certificate expires.