Safari's Warning Screen for Invalid SSL/TLS Certificates

This article provides a complete overview of the security warning screen displayed by the Safari web browser when it encounters an expired, self-signed, or mismatched SSL/TLS certificate. It details the exact warning messages presented to the user, explains how different certificate errors trigger this alert, and outlines the available options for navigating away from or bypassing the warning screen.

The "This Connection Is Not Private" Screen

When Safari detects a problem with a website's SSL/TLS certificate, it immediately blocks access to the page and displays a full-screen interstitial warning. The primary header of this warning screen reads: "This Connection Is Not Private."

Directly beneath this header, Safari displays the following message: > "This website may be impersonating "[Website URL]" to steal your personal or financial information. You should go back to the previous page."

On iOS and iPadOS devices, the final sentence may alternatively read, "You should close this page." The purpose of this stark messaging is to alert the user that the encrypted connection between their browser and the web server cannot be verified as secure.

What Triggers This Warning

Safari displays the exact same primary warning screen for all three of the most common certificate errors, though the underlying causes differ:

  • Expired Certificate: The SSL/TLS certificate has passed its validity date. Because the website owner failed to renew it, Safari can no longer guarantee the site's current security status.
  • Self-Signed Certificate: The certificate was created and signed by the website's own server rather than a trusted third-party Certificate Authority (CA). Safari does not automatically trust self-signed certificates because anyone, including an attacker, can generate one.
  • Mismatched Certificate: The domain name listed on the SSL/TLS certificate does not match the actual URL typed into the Safari address bar. This often happens due to server misconfiguration, where multiple websites share an IP address, or during a Man-in-the-Middle (MitM) attack.

User Options on the Warning Screen

Safari presents two interactive buttons at the bottom of the warning box: "Go Back" (or "Close Page") and "Show Details."

1. Go Back / Close Page

This button is highlighted in blue as the default, recommended action. Clicking it safely removes the user from the potentially compromised connection and returns them to their previous webpage or closes the tab.

2. Show Details

If a user clicks "Show Details," the warning box expands to provide more context and a way to bypass the block. The expanded text states:

"Safari warns you when a website has a certificate that is not valid. This may happen if the website is misconfigured or an attacker has compromised your connection."

Below this explanation, Safari provides two links:

  • "view the certificate": Clicking this opens a pop-up window displaying the technical details of the SSL/TLS certificate. Here, the user can see the exact reason for the failure, such as "This certificate has expired," "This certificate was signed by an untrusted issuer," or "Host name mismatch."
  • "visit this website": Clicking this link allows the user to bypass the security warning.

Bypassing the Warning

If the user chooses to click "visit this website," Safari initiates a secondary confirmation prompt asking: "Are you sure you want to visit this website on an insecure connection?"

If the user confirms by clicking "Visit Website":

  • On macOS: The operating system requires the user to enter their Mac administrator password or use Touch ID to authorize adding an exception for the invalid certificate to the macOS Keychain.
  • On iOS/iPadOS: The browser simply reloads the page and establishes the insecure connection without requiring a device passcode.

Once bypassed, the website will load, and Safari will display a "Not Secure" label in the address bar to remind the user that the connection remains unverified. Note that if the website uses HTTP Strict Transport Security (HSTS), Safari may still block the connection entirely or make the bypass option significantly harder to access, as HSTS strictly forbids loading a site with certificate errors.