` reads). %> Fix "This Connection Is Not Private" in Safari (Mac & iPhone) | TLS Radar Skip to main content
troubleshooting 3 min read By TLS Radar Team

Fix "This Connection Is Not Private" in Safari (Mac & iPhone)

Safari shows 'This Connection Is Not Private' - identical wording on macOS and iOS - when it cannot verify a site's SSL certificate against Apple's trust store. Beyond the usual expired, hostname-mismatch, and untrusted-issuer causes, Safari has two strict rules of its own: it rejects publicly-trusted certificates with validity over 397 days even if they have not expired, and it distrusts anything chaining to the legacy Symantec PKI. A wrong device clock is a common cause on iOS.

Safari shows "This Connection Is Not Private" when it can't establish a trusted HTTPS connection to a site. The warning is identical in wording across macOS Safari and iOS Safari, though the visual treatment differs. This guide covers what the warning means and how to fix it - for both visitors and site owners.

What Safari is checking

Safari uses Apple's trust store (maintained in macOS, iOS, iPadOS, and watchOS) to verify the SSL certificate the server presents. Three checks must pass:

  • Validity dates - the certificate's notBefore and notAfter bracket the current time.
  • Hostname match - the domain you're visiting appears on the certificate's SAN list.
  • Trust chain - the certificate chains up to a CA in Apple's trust store.

Safari is particularly strict about certificate lifetimes. Since 2020, Safari has enforced a maximum validity of 397 days for publicly-trusted certificates - certificates issued for longer periods are rejected even if their notAfter dates are in the future.

What the warning page shows

Safari shows "This Connection Is Not Private" with an exclamation-triangle. Clicking "Show Details" reveals more information about the failure. The specific reasons Safari displays:

  • "The certificate for [hostname] has expired" - date check failed.
  • "The certificate for [hostname] is not yet valid" - the start date is in the future (often a clock-skew issue).
  • "The certificate for [hostname] is invalid" - generic message used for hostname mismatch and trust-chain issues.
  • "Safari cannot verify the identity of [hostname]" - issuer not trusted.

If you're a visitor seeing this warning

The safe move is to leave the site. The warning means trust can't be established - entering passwords or payment information is risky.

Reasonable exceptions:

  • The site is yours - use the site-owner fixes below.
  • Your device's date and time are wrong. Tap Settings → General → Date & Time → Set Automatically on iOS, or open System Settings → Date & Time on macOS. A wrong clock can make valid certificates appear expired.
  • You're on a corporate network that does TLS inspection. Your IT team may have installed an internal CA on managed devices - if your work device is missing it, contact IT rather than clicking through.

If you own the site and need to fix it

For "The certificate has expired"

Get a new certificate. The quickest path is a free Let's Encrypt certificate via Beacon:

Need a working certificate right now?

Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow. No account, no command-line tools, no ACME client to install - just a domain you control. Most people get a working certificate in under 10 minutes.

Get a free certificate from Beacon

For "The certificate is invalid" (hostname mismatch)

The certificate exists and isn't expired, but doesn't cover the hostname Safari is connecting to. The fix:

  • Issue a new certificate with the hostname on its SAN list, or
  • Check that your server is serving the right certificate for the right hostname (SNI configuration).

Wildcard certificates are a common source of this issue. *.example.com covers www.example.com but not api.eu.example.com (wildcards only cover one level deep).

For "Safari cannot verify the identity" (untrusted issuer)

Your certificate is signed by an issuer Apple's trust store doesn't include. Most commonly: a self-signed certificate, an internal CA that hasn't been distributed to client devices, or (rarely) a CA that Apple has distrusted. Switch to a publicly-trusted CA like Let's Encrypt, DigiCert, Sectigo, or Entrust.

For certificates that look valid but Safari still rejects

Two Safari-specific causes worth checking:

  • Validity period over 397 days. Safari rejects publicly-trusted certificates issued for more than 397 days, even if they haven't expired. If you bought a 2-year certificate from a commercial CA before 2020, this may apply. Reissue for a shorter period.
  • Symantec-rooted certificates. Safari (along with Chrome) distrusts all certificates issued by the legacy Symantec PKI. If your certificate ultimately chains up to a Symantec root, it won't be trusted regardless of expiry - reissue from a different CA.

iOS vs macOS Safari

The warning is identical in wording on both. The trust store is shared between Safari (macOS), Safari (iOS/iPadOS), and most other Apple apps. Fixing a certificate problem on the server fixes it for all Apple devices simultaneously.

Prevent this from happening again

Stop this from happening again

TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.

Sign Up Talk to us about enterprise solutions

Related reading

Frequently asked questions

What does 'This Connection Is Not Private' mean in Safari?
It means Safari could not verify the site's SSL certificate against Apple's trust store. Safari checks the certificate's validity dates, whether it covers the hostname, and whether it chains to a trusted CA. 'Show Details' reveals the specific reason, such as expired, invalid (hostname or chain), or 'cannot verify the identity' (untrusted issuer).
Why does Safari reject a certificate that hasn't expired?
Two Safari-specific rules. Safari rejects publicly-trusted certificates issued for more than 397 days even if their end date is in the future, so an older 2-year certificate fails - reissue for a shorter period. Safari also distrusts anything chaining to the legacy Symantec PKI regardless of expiry - reissue from a different CA.
How do I fix 'Safari cannot verify the identity'?
That means the issuer is not in Apple's trust store, usually a self-signed certificate or an internal CA that has not been distributed to devices. Switch to a publicly-trusted CA like Let's Encrypt, DigiCert, or Sectigo. For an internal tool, have IT distribute the CA to your devices.
The site loads on my computer but not my iPhone - why?
Safari on iOS and macOS share Apple's trust store and show the same warning, so a difference is usually device-specific: most often a wrong date and time on one device, which makes valid certificates look expired. Set the clock to update automatically and retry.

Get the next post in your inbox

TLS monitoring tips and product updates. No spam, unsubscribe anytime.

Keep reading

troubleshooting 4 min

Fix "Your Connection Is Not Private" in Chrome
troubleshooting 3 min

Fix "Warning: Potential Security Risk Ahead" in Firefox
troubleshooting 4 min

Fix Browser Security Warnings in Brave

Comparing tools? See how TLS Radar stacks up against DigiCert and SSL.com.