Fix iOS 17 'Cannot Verify Server Identity' Error

You’re sitting in a coffee shop, try to check your work email on your iPhone, and bam — “Cannot Verify Server Identity” pops up. Sometimes it appears in Safari, sometimes in the Mail app, and it's a pain in the ass. The trigger? Usually a corporate Wi-Fi network with a captive portal, a self-signed certificate on your internal server, or a VPN that uses certificate authentication. I’ve seen it when a client’s SSL cert expired and their IT department hasn't renewed it yet. You tap “Details,” and you get the option to trust, but even after trusting, the error keeps coming back. Frustrating, right?

The root cause is almost always a mismatch between what the server presents and what iOS trusts. iOS 17 tightened up certificate validation. It now enforces stricter checks on certificate chains, including intermediate certificates, and it caches SSL session states aggressively. So even if you trust the certificate once, iOS might still be holding onto an older, invalid session. Or the server’s certificate chain is incomplete — missing an intermediate cert. The fix is to force iOS to re-evaluate the certificate chain from scratch.

What Actually Fixes This

Stop messing around with toggling Wi-Fi off and on. That doesn’t clear the SSL session cache. Here’s what you do:

Clear Safari’s cache (if the error appears in Safari):
Go to Settings > Safari > Clear History and Website Data. Yeah, it wipes your browsing history, but it also kills the cached SSL state. Worth the trade-off.
Delete the mail account (if the error is in Mail):
For email, remove the account entirely. Settings > Mail > Accounts, tap the account, and hit “Delete Account.” Then re-add it. This forces a fresh handshake with the mail server.
Install the certificate properly (if it’s a self-signed or internal cert):
If you’re hitting an internal server, you need to install the root certificate on your iPhone. Get the cert file (usually a .cer or .pem) from your IT admin. Open it in Safari, then go to Settings > General > About > Certificate Trust Settings and toggle on “Enable Full Trust for Root Certificates.” Don’t skip this — it’s the difference between a permanent fix and a temporary one.
Restart your iPhone.
Sounds dumb, but a reboot clears system caches. Do it after the above steps.

Here’s the command-line equivalent if you’re on a Mac and want to test the server’s cert chain before you even touch the phone:

openssl s_client -connect yourserver.com:443 -showcerts

That will show you the whole chain. Look for “verify error” messages. If you see “unable to get local issuer certificate,” then the server is missing an intermediate CA. That’s a server-side issue, not your phone.

Still Failing? Check These

If you went through all that and the error still pops up, you’re dealing with one of these:

Expired or misconfigured server certificate. Check the validity dates with openssl s_client or an online tool. If it’s expired, the fix is on the server, not your phone.
Certificate pinning in the app. Some apps (like banking apps or corporate portals) pin certificates. They only trust a specific cert, period. If the server changes its cert, the app rejects it. You can’t fix that from the client side — the app vendor or IT needs to update the pin.
DNS hijacking or a proxy in the middle. On a public Wi-Fi, someone could be intercepting HTTPS. Try switching to cellular data. If the error disappears, then it’s the network, not your phone.
Date and time settings. iOS uses the device clock to validate certs. If your time is off by more than a few minutes, everything breaks. Go to Settings > General > Date & Time and switch “Set Automatically” to on. I’ve seen this one more times than I care to admit.

The Server-Side Fix (If You Control the Server)

If you’re the one managing the server and your users are hitting this, fix the chain. Don’t just throw the leaf certificate on the server. Include the intermediate CA bundle. For Apache, that’s SSLCertificateChainFile. For nginx, it’s the ssl_certificate directive with both the server cert and the intermediates concatenated in one file.

Also, don’t use SHA-1 certs. iOS 17 flat-out rejects them. If your cert is SHA-1, reissue with SHA-256. That’s non-negotiable.

In my 14 years doing this, I’ve learned that most “Cannot Verify Server Identity” issues are either a missing intermediate CA or a stale SSL session on the device. The steps above cover both. If you’re still stuck after all that, check if the server is actually presenting the right cert — I’ve had clients point DNS to the wrong server entirely and spend days chasing their tail.

One last thing — don’t bother with “Reset Network Settings” unless you’re desperate. It nukes your Wi-Fi passwords and VPN configs, and it rarely helps with cert errors. Stick with the steps above, and you’ll be fine.