Fix iOS 17 'Cannot Verify Server Identity' Error

iOS 17 throws this when a site's SSL cert chain is incomplete or outdated. It's not a hack — it's a trust issue. Here's how to fix it in under a minute.

Quick answer

Go to Settings > General > About > Certificate Trust Settings and toggle on full trust for the relevant root certificate, or simply update iOS and try a different network.

What's actually happening here is that your iPhone or iPad can't confirm the SSL certificate chain for the server you're trying to reach. It isn't a sign that you're being attacked — it's that your device doesn't recognize the certificate authority (CA) that signed the server's certificate, or the chain between the server's cert and a trusted root is broken. iOS 17 tightened up how it validates certificates, so many older or self-signed certs that worked before now trigger this warning.

This pops up most often on corporate Wi-Fi portals, on older internal websites, or when you're using a VPN that intercepts HTTPS traffic. The error text usually appears in Safari, Mail, or when connecting to a Wi-Fi network that forces you through a login page. It can also show up when the date and time on your device are wrong, because certificate validation depends on the current time being within the cert's validity period.

Fix steps

Check your date and time. Go to Settings > General > Date & Time and turn on Set Automatically. If it's already on, toggle it off and on again. Wrong time is the most common cause that people overlook — and it takes ten seconds to rule out.
Update iOS. Open Settings > General > Software Update and install any pending update. Apple periodically adds new trusted root certificates and patches validation bugs. If you're on 17.0.x, there were known issues that got fixed in 17.1 and later.
Try a different network. Switch from Wi-Fi to cellular (or vice versa). If the error disappears, the problem is the network — often a captive portal or a misconfigured router. Forget the Wi-Fi network in Settings > Wi-Fi and reconnect.
If you're on a corporate or school network, install the root certificate. Ask your IT admin for the CA certificate file (usually a .cer or .pem). AirDrop it to your iPhone, tap it, and let it install as a profile. Then go to Settings > General > About > Certificate Trust Settings and enable full trust for that certificate.
For Safari specifically, try a different browser. If Chrome or Firefox loads the site fine, the issue might be Safari's stricter handling. Clear Safari's history and cookies first — sometimes a corrupt cache triggers false negatives.

If the main fix doesn't work

When the above steps don't clear it, you're looking at a trickier situation. Here's what to try next:

Reset network settings. Go to Settings > General &strong> Transfer or Reset iPhone > Reset > Reset Network Settings. This wipes saved Wi-Fi passwords and VPN configs, so only do it if you're comfortable re-entering those. It clears any stale certificate caches stored per-network.
Inspect the certificate yourself. Use a third-party SSL checker like sslshopper.com from your Mac or PC, entering the failing domain. If the tool shows an untrusted root or a missing intermediate certificate, the site admin needs to fix it on the server — no amount of iPhone tweaking will help.
For Mail accounts, delete and re-add the account. This forces iOS to re-fetch the server's certificate and re-validate it. Go to Settings > Mail > Accounts, remove the problematic account, then add it back.

Prevention

The real fix is on the server side. If you control the website, make sure your SSL certificate chain is complete — many hosting panels let you download an intermediate bundle and you need to install that alongside your main cert. Losing the intermediate chain is the number one reason iOS rejects otherwise valid sites.

For personal use, keep your iPhone updated and avoid connecting to unknown Wi-Fi networks that force you through login pages — those often use self-signed certs. If you see the error on a site you trust, it's almost always a server configuration issue, not a security threat.

Pro tip: If you're an IT admin, use a tool like openssl s_client -connect yourdomain.com:443 to see exactly what cert chain you're serving. Fixing it there prevents hundreds of user support tickets.