What Safari shows, and what we will not pretend to know
Apple does not publish these strings the way Google and Mozilla publish theirs, and the exact wording varies between Safari versions and between macOS, iOS and iPadOS. So treat any guide quoting Safari sentence for sentence with some caution, including screenshots that may be several versions old.
What is safe to say about how the page behaves:
- →The heading is in title case, which is Apple's house style. Chrome and Firefox use sentence case. That alone tells you which browser a screenshot came from.
- →There is no error code. No NET::ERR_ style string, and no Firefox style SEC_ERROR_ code. This is the single biggest practical difference, because there is nothing specific to search for.
- →It frames the problem as impersonation. Safari leans on the idea that the site may not be the site it claims to be, rather than Chrome's framing of attackers trying to steal your information.
- →Older versions used a different heading built around Safari being unable to verify the identity of the website. If you see that, you are on an older release, and the meaning is the same.
Why the missing code matters more than it sounds
In Chrome you copy NET::ERR_CERT_DATE_INVALID into a search box and get an answer in seconds. In Firefox you copy SEC_ERROR_UNKNOWN_ISSUER and do the same.
In Safari you have a sentence, and the sentence is not distinctive enough to identify the fault. Two completely different problems, an expired certificate and a certificate issued for the wrong hostname, produce a page that looks the same to you.
That is why so much Safari advice online is generic and unhelpful. It is written without knowing which fault is being described.
The way around it is to stop trying to read the cause off the page and check the certificate itself, which is exactly what the checker at the top of this page does.
The same three causes, every time
Safari hides the code, not the cause. It is one of these.
- →The certificate expired. Chrome calls it NET::ERR_CERT_DATE_INVALID, Firefox calls it SEC_ERROR_EXPIRED_CERTIFICATE. Also fires when your own device clock is wrong.
- →The certificate does not cover the address. Chrome calls it NET::ERR_CERT_COMMON_NAME_INVALID, Firefox calls it SSL_ERROR_BAD_CERT_DOMAIN. Usually a missing www.
- →The chain does not reach a trusted authority. Chrome calls it NET::ERR_CERT_AUTHORITY_INVALID, Firefox calls it SEC_ERROR_UNKNOWN_ISSUER. Usually a missing intermediate certificate, sometimes a self-signed certificate.
How to diagnose it without a code
Four checks, in order, and you will know which of the three you have.
- 1.Check the date and time on your device. If every secure site fails at once, this is almost certainly it. Turn on automatic time and reload.
- 2.Try one other site. If everything else is fine, the fault is that site rather than your Mac, iPhone or network.
- 3.Try the address with and without www. If one version loads cleanly, the certificate does not cover both, and you have identified the cause.
- 4.Open the same address in Chrome or Firefox. They will hand you the error code Safari withheld, and the code names the fault exactly.
- 5.Or skip all of that and paste the address into the checker at the top of this page. It reports the certificate status without you loading the site at all.
One Safari specific thing worth knowing
Firefox is unusual in that it verifies certificates against the Mozilla CA store rather than certificates supplied by the user's operating system. Safari is the opposite end of that: it works with the trust settings of the Apple system it runs on.
In practice that matters if a work profile, a device management setup, or a security app has installed its own root certificate on the device. Those can make sites behave differently on a managed Mac or iPhone than on a personal one. If a site fails only on your work device, that is where to look, and your IT team can answer it in a moment.
Frequently asked questions
Why does Safari not show an error code?
Apple simply does not surface one on the warning page. Chrome shows NET::ERR_ codes and Firefox shows SEC_ERROR_ codes, both of which you can search. Safari gives you a plain explanation instead, which is friendlier to read and much harder to act on.
Is the exact wording on my screen the same as everyone else's?
Not necessarily. Apple does not publish these strings and they vary between Safari versions and between macOS, iOS and iPadOS. Older releases used a heading about Safari being unable to verify the website's identity. The meaning is the same in every version: the certificate could not be verified.
Does this mean someone is attacking me?
Usually not. Most of these warnings come from an expired or misconfigured certificate on the site. Safari frames it as the site possibly not being what it claims to be, which is the honest description, because the browser cannot tell a mistake from an impersonation. Either way, do not enter anything sensitive.
It only happens on my iPhone, not my Mac. Why?
Check the date and time on the phone first, since a wrong clock on one device produces exactly this. After that, consider the network. A public or workplace Wi-Fi network can intercept connections in a way your home network does not, so retry on mobile data to compare.
Should I visit the site anyway?
Not for anything with a login or a payment. Safari stopped because it could not confirm the site is genuine, and continuing does not resolve that. Check the address with the tool above, and if it is a business you deal with, contact them another way and tell them their certificate is failing.