iOS 17 "Cannot Verify Server Identity" — Real Fixes

You're on Wi-Fi at a coffee shop, or trying to check your work email, and your iPhone throws up "Cannot Verify Server Identity". The connection just stops. What's actually happening here is that iOS can't validate the server's SSL/TLS certificate — either because the date is wrong, the Wi-Fi network is intercepting traffic, or the certificate itself has been revoked.

I've been maintaining this wiki for years, and this error pops up reliably on iOS 17 after a big OS update or when connecting to enterprise Wi-Fi with captive portals. Let's kill the noise and fix it.

1. Date & Time Not Set Automatically

This is the most common cause, and it's stupidly simple. An SSL certificate has a valid-from and valid-to date range. If your iPhone's clock is off by more than a few minutes, the certificate looks expired to iOS. This happens after a battery drain to zero, a long flight where you manually set the time, or a bug in iOS 17.0.3 that sometimes resets the time zone.

The Fix

1. Open Settings → General → Date & Time.
2. Turn Set Automatically OFF, then turn it back ON.
3. Force-close Safari or Mail (swipe up from app switcher) and retry.

The reason this works: iOS re-queries Apple's time servers (time.apple.com) and corrects the clock. If your iPhone is still showing the wrong time after toggling, you've got a deeper network issue — check your Wi-Fi connection or switch to cellular to force a time sync. I've seen this fail when the device is behind a corporate proxy that blocks NTP traffic.

2. Captive Portal or Intercepted Wi-Fi Network

Second most common: you're on a public Wi-Fi network that requires you to accept terms or log in. The router redirects all traffic to its login page before handing out a real IP. Your iPhone sees a certificate from the router's captive portal (which is self-signed) and refuses to trust it. The error message is the same: "Cannot Verify Server Identity."

The Fix

1. Open Safari and try to load any HTTP page (like http://captive.apple.com — Apple's own captive portal detection URL).
2. If you see a login page, complete the authentication.
3. If you don't see a login page, but the error persists, go to Settings → Wi-Fi, tap the blue (i) icon next to the network name, and turn off Auto-Join. Then toggle Wi-Fi off and on.

What's happening under the hood: iOS uses a built-in captive portal detector that hits captive.apple.com. If that URL returns something other than a 200 with a specific content body, iOS knows you're on a captive network. But sometimes the detection fails silently, and your secure connections (HTTPS) get intercepted by the router's proxy. The real fix here is to authenticate through the captive portal first, then let iOS rebuild its trust cache. If you're still stuck, forget the network and rejoin — that forces a fresh DHCP lease and re-triggers the captive portal detection.

3. Revoked or Expired Server Certificate

Less common, but when it hits, it's the server's fault, not yours. The site or mail server you're connecting to has a certificate that's been revoked (added to Apple's Certificate Revocation List) or has expired. This happens when an IT admin forgets to renew an SSL cert, or when they switch to a new CA and don't update the intermediate chain. You'll see this with internal company websites, older mail servers, or poorly maintained APIs.

The Fix (User Side)

1. Try connecting over cellular instead of Wi-Fi — if it works, it's a network-level cert interception issue (see cause 2).
2. If it fails on cellular too, the server itself is the problem. Contact the site admin or your IT department.
3. As a last resort, you can manually trust the certificate in iOS — only do this if you're absolutely sure it's safe. Go to Settings → General → About → Certificate Trust Settings and enable the root certificate if it's listed there. Apple only allows this for installed configuration profiles.

The reason you can't just "accept" the certificate like on a desktop: iOS enforces certificate trust at the OS level for all apps. There's no "Add Exception" button like in Firefox. Apple's stance is that a revoked cert means the server is compromised — and they're right. Don't bypass this unless you've verified the certificate hash with the server admin. I've seen this exact scenario break internal MDM deployments when a company's internal CA root expired and no one updated the profile.

Quick-Reference Fixes

That's it. Three causes, three fixes. If none of these work, check if you've installed a VPN profile that's intercepting traffic — iOS 17 added stricter checks for VPN certificates, and a misconfigured WireGuard profile can trigger this error too.