Safari shows "This Connection Is Not Private" when it can't establish a trusted HTTPS connection to a site. The warning is identical in wording across macOS Safari and iOS Safari, though the visual treatment differs. This guide covers what the warning means and how to fix it - for both visitors and site owners.
What Safari is checking
Safari uses Apple's trust store (maintained in macOS, iOS, iPadOS, and watchOS) to verify the SSL certificate the server presents. Three checks must pass:
- Validity dates - the certificate's
notBeforeandnotAfterbracket the current time. - Hostname match - the domain you're visiting appears on the certificate's SAN list.
- Trust chain - the certificate chains up to a CA in Apple's trust store.
Safari is particularly strict about certificate lifetimes. Since 2020, Safari has enforced a maximum validity of 397 days for publicly-trusted certificates - certificates issued for longer periods are rejected even if their notAfter dates are in the future.
What the warning page shows
Safari shows "This Connection Is Not Private" with an exclamation-triangle. Clicking "Show Details" reveals more information about the failure. The specific reasons Safari displays:
- "The certificate for [hostname] has expired" - date check failed.
- "The certificate for [hostname] is not yet valid" - the start date is in the future (often a clock-skew issue).
- "The certificate for [hostname] is invalid" - generic message used for hostname mismatch and trust-chain issues.
- "Safari cannot verify the identity of [hostname]" - issuer not trusted.
If you're a visitor seeing this warning
The safe move is to leave the site. The warning means trust can't be established - entering passwords or payment information is risky.
Reasonable exceptions:
- The site is yours - use the site-owner fixes below.
- Your device's date and time are wrong. Tap Settings → General → Date & Time → Set Automatically on iOS, or open System Settings → Date & Time on macOS. A wrong clock can make valid certificates appear expired.
- You're on a corporate network that does TLS inspection. Your IT team may have installed an internal CA on managed devices - if your work device is missing it, contact IT rather than clicking through.
If you own the site and need to fix it
For "The certificate has expired"
Get a new certificate. The quickest path is a free Let's Encrypt certificate via Beacon:
Need a working certificate right now?
Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow. No account, no command-line tools, no ACME client to install - just a domain you control. Most people get a working certificate in under 10 minutes.
Get a free certificate from BeaconFor "The certificate is invalid" (hostname mismatch)
The certificate exists and isn't expired, but doesn't cover the hostname Safari is connecting to. The fix:
- Issue a new certificate with the hostname on its SAN list, or
- Check that your server is serving the right certificate for the right hostname (SNI configuration).
Wildcard certificates are a common source of this issue. *.example.com covers www.example.com but not api.eu.example.com (wildcards only cover one level deep).
For "Safari cannot verify the identity" (untrusted issuer)
Your certificate is signed by an issuer Apple's trust store doesn't include. Most commonly: a self-signed certificate, an internal CA that hasn't been distributed to client devices, or (rarely) a CA that Apple has distrusted. Switch to a publicly-trusted CA like Let's Encrypt, DigiCert, Sectigo, or Entrust.
For certificates that look valid but Safari still rejects
Two Safari-specific causes worth checking:
- Validity period over 397 days. Safari rejects publicly-trusted certificates issued for more than 397 days, even if they haven't expired. If you bought a 2-year certificate from a commercial CA before 2020, this may apply. Reissue for a shorter period.
- Symantec-rooted certificates. Safari (along with Chrome) distrusts all certificates issued by the legacy Symantec PKI. If your certificate ultimately chains up to a Symantec root, it won't be trusted regardless of expiry - reissue from a different CA.
iOS vs macOS Safari
The warning is identical in wording on both. The trust store is shared between Safari (macOS), Safari (iOS/iPadOS), and most other Apple apps. Fixing a certificate problem on the server fixes it for all Apple devices simultaneously.
Prevent this from happening again
Stop this from happening again
TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes (chain breaks, weak ciphers, hostname mismatches) that expiry-only monitoring misses. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.
Related reading
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.