Bug #3255

Safari 6.0 fails to connect to Metacat MN with SSLVerifyClient

Added by Mark Servilla about 10 years ago. Updated about 8 years ago.

Target version:
Start date:
Due date:
% Done:


Product Version:
Story Points:


Safari 6.0 web browser on OS X 10.8 and 10.7 fails to connect to a Metacat Member Node when using the Apache web server setting "SSLVerifyClient Optional".

This issue originated from an LTER Information Manager (Sven Bohm - KBS) when he attempted to connect to the URL "", which resulted in the following Safari error message (see LTER RT Ticket #2053 -

Safari can't open the page "" because Safari can't establish a secure connection to the server "".

This error was confirmed by Mark Servilla using Safari on both Mac OS X 10.7 and 10.8; this error also occurs on "" as of 2012-09-17T13:00.

This issue is apparently the result of the Safari 6.x web browser not supporting web servers that require or even make optional "SSLVerifyClient" during peer renegotiation and has been an issue since Safari 5.x (see:,, - this conclusion is not verified.

To mitigate this issue on (, the Apache2 web server had the following directive inserted, which isolates the need for client certificate verification to only DataONE related communication while in the "knb" context:

SSLVerifyClient Optional
SSLVerifyDepth 10

Note: Safari requests that require communication with D1 services on this Metacat will still result in a connection failure.

Local testing indicates that Safari now successfully connects to; Ben Leinfelder (NCEAS) confirms that peer communication between this Metacat instance and D1 still succeeds after making the Apache2 configuration change.

Sven Bohm confirmed that he was now able to successfully access "".

Related issues

Related to Infrastructure - Bug #2693: Error -1205 "Client Certificate Rejected" by Safari Closed


#1 Updated by Dave Vieglais about 10 years ago

  • Tracker changed from MNDeployment to Bug

#2 Updated by Dave Vieglais almost 10 years ago

  • Project changed from Member Nodes to Infrastructure
  • Start date deleted (2012-09-17)
  • translation missing: en.field_remaining_hours set to 0.0
  • Milestone set to None

#3 Updated by Skye Roseboom about 8 years ago

  • Status changed from New to Rejected

Also available in: Atom PDF

Add picture from clipboard (Maximum size: 14.8 MB)