Safari 'Your connection is not private' fix for SSL certs on macOS

Quick answer for advanced users

Open Keychain Access, find your certificate under System, double-click it, expand Trust, set "When using this certificate" to Always Trust, then close and enter your password. Quit Safari, then run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder in Terminal to clear DNS and cache. Relaunch Safari—it should work now.

Why this happens

You installed a self-signed or internal CA certificate on your Mac—maybe for a corporate intranet, a local dev server like *.local, or a private web app. Safari, unlike Chrome or Firefox, has its own certificate trust store that doesn't automatically trust certificates you add to the System keychain. On macOS Ventura and later, Safari also caches SSL sessions aggressively. So even when you tell the system to trust a cert, Safari still remembers the old rejection and shows that "Your connection is not private" page. The fix is two-fold: trust the certificate explicitly in Keychain Access, then wipe Safari's SSL cache. Skipping either step leaves you stuck.

Step-by-step fix

1. Open Keychain Access. Press Cmd+Space, type "Keychain Access", hit Enter.
2. Find your certificate. In the left sidebar, click "System". Look for your certificate in the list—it might be under "Certificates" category. If you don't see it, you might have installed it to "login" keychain by accident. If so, drag it from login to System keychain in the left panel. You'll be prompted for your password.
3. Open the certificate. Double-click your certificate. A window with multiple sections appears.
4. Expand Trust. Click the triangle next to "Trust" to expand that section. You'll see three drop-down menus.
5. Set to Always Trust. Change the first drop-down ("When using this certificate") to Always Trust. The other two should auto-set to Always Trust too. If not, set them manually.
6. Close the window. Click the red close button. It asks for your Mac password or Touch ID. Enter it. You should see a prompt: "Do you want to change the trust settings for this certificate?" Click "Update Settings".
7. Quit Safari completely. Not just close the window. Press Cmd+Q or right-click Safari in Dock and choose Quit.
8. Clear DNS and cache. Open Terminal (from Utilities folder or Spotlight). Paste this command and press Enter:
   

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

   Enter your password when asked. You won't see any output—that's normal.
9. Open Safari and test. Go back to the website that gave the error. It should load without the warning now. If it still shows, you might need to restart your Mac—some older macOS versions (Monterey and earlier) need a full reboot to pick up certificate trust changes.

Alternative fixes if the main one fails

Check the certificate's date

Open the certificate in Keychain Access again. Look at the "Validity" section—if it says "This certificate is not valid" or the dates are wrong, the system won't trust it no matter what. Reissue the cert with correct dates.

Use the login keychain instead

Some corporate IT setups require the certificate to be in the login keychain, not System. Drag the cert from System to login in Keychain Access. Then double-click it in login keychain and set Trust to Always Trust. This works for some VPN or proxy certificates.

Disable Safari's Private Browsing mode

If you're using Private Browsing, Safari is stricter about certs. Close all Private tabs, then try the site in a regular window. If it works, the cert is trusted but your Private Browsing session cached the error. Quit Safari and reopen—don't use Private Browsing for that site.

Reset Safari completely

This is nuclear but effective. Open Safari, go to Safari menu > Settings (or Preferences on older macOS). Click the Privacy tab. Click "Manage Website Data..." then "Remove All". Confirm. Quit Safari. Then in Finder, press Cmd+Shift+G, type ~/Library/Caches/com.apple.Safari, delete everything inside that folder. Empty Trash. Reopen Safari. This clears every SSL session and cache—your bookmarks and passwords stay safe.

Check for conflicting profiles

If you have a mobile device management (MDM) profile installed, it might override your trust settings. Go to System Settings > General > Profiles (or Device Management). If you see a profile, click it and look for certificate trust policies. You might need your IT admin to update the profile. This is rare but happens with corporate Macs.

Prevention tip

Next time you install a certificate, do it through Safari itself instead of manually. Browse to your site, click the warning page, then click "Show Details" and "Visit this website". Safari will ask if you trust the certificate. Click "Trust". This automatically adds the cert to your System keychain with the right trust settings. But if you already went through the manual install, the steps above fix it.

Also, don't mix keychains. Keep corporate or dev certs only in the System keychain—mixing login and System causes confusion. If you ever upgrade macOS (e.g., from Monterey to Sonoma), some certs lose trust settings. You'll need to re-do the trust step after the upgrade. Write a reminder in your calendar.