How to Inspect SSL Certificates and TLS Handshake Details in Safari Web Inspector

Transport Layer Security (TLS) is the foundation of modern web security, providing end-to-end cryptographic encryption, data integrity, and server authentication for HTTPS traffic. When establishing secure sessions between Safari on macOS and remote origin servers, WebKit negotiates TLS protocol versions, cipher suites, key exchange algorithms, and certificate validation chains. While modern browsers display a simple padlock icon in the address bar to indicate a valid HTTPS connection, developers, penetration testers, and system administrators often need to inspect low-level cryptographic parameters to diagnose handshake errors, identify weak cipher suites, verify Certificate Transparency (CT) logs, or audit Intermediate CA chains.

Safari on macOS provides complete cryptographic visibility directly inside Safari Web Inspector. The Network tab’s dedicated Security inspector enables developers to inspect server certificates, examine Subject Alternative Names (SANs), verify TLS 1.3 protocol negotiation, audit OCSP stapling responses, and troubleshoot mixed-content warnings.

Understanding TLS Handshake Architecture in WebKit and macOS

Unlike browsers that bundle independent cryptographic libraries (such as Chromium using BoringSSL or Firefox using NSS), Safari on macOS relies on Apple’s native Security.framework and Network.framework. When Safari initiates an HTTPS connection, the macOS operating system performs a series of cryptographic exchanges:

• ClientHello / ServerHello: Negotiates the highest mutually supported TLS version (such as TLS 1.3 or TLS 1.2) and selects an agreed-upon cipher suite (such as TLS_AES_128_GCM_SHA256 or ECDHE-RSA-AES256-GCM-SHA384).
• Key Exchange: Establishes forward-secret session keys using Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) or post-quantum hybrid key agreements.
• Certificate Chain Validation: Validates the leaf server certificate against intermediate certification authorities and trusted Root CAs residing in the macOS System Keychain.
• Revocation & Certificate Transparency: Checks Online Certificate Status Protocol (OCSP) stapling and verifies Signed Certificate Timestamps (SCTs) embedded within the certificate.

Accessing the Security Details in Safari Web Inspector

To inspect SSL certificates and cryptographic handshake parameters in Safari:

1. Open Safari on macOS and navigate to the target HTTPS website.
2. Ensure the Develop menu is enabled via Safari > Settings > Advanced > Show features for web developers.
3. Right-click anywhere on the webpage and select Inspect Element (or press Option + Command + I).
4. In Web Inspector, click on the Network tab in the main navigation bar.
5. Reload the webpage (press Command + R) to capture all HTTP and HTTPS resource requests.

Inspecting Server Certificates and Cipher Suites

In the Network tab’s resource list, select the primary document request (typically the top-most HTML resource representing your root domain):

1. In the right-hand details pane, locate the tab navigation buttons (Headers, Preview, Response, Cookies, Security).
2. Click on the Security tab (represented by a lock icon).

Web Inspector renders a comprehensive breakdown of the established secure connection:

1. Connection Protocol and Cipher Suite

The top section displays the negotiated cryptographic parameters:

• Protocol: Identifies the active TLS version (e.g. TLSv1.3 or TLSv1.2). Connections operating on TLS 1.0 or 1.1 are actively flagged as insecure.
• Cipher Suite: Shows the cryptographic algorithms used for bulk encryption, message authentication, and integrity (e.g. TLS_AES_256_GCM_SHA384).
• Key Exchange: Confirms the ephemeral curve used for perfect forward secrecy (e.g. X25519 or secp256r1).

2. Certificate Hierarchy and Validity Period

The middle section visualises the full trust chain:

• Leaf / Server Certificate: Issued to the target domain name.
• Intermediate Certificate Authority (CA): The issuing authority (such as Let’s Encrypt R10 or DigiCert Global Root G2).
• Root Certificate: The anchor certificate validated against the macOS Keychain.

Inspect the Valid From and Valid Until timestamps to verify that automated certificate renewal daemons (such as Certbot) have renewed certificates well before expiration dates.

3. Subject Alternative Names (SAN)

Modern browsers ignore the legacy Common Name (CN) attribute and strictly validate domain names using Subject Alternative Names (SANs). Expand the certificate details to inspect the SAN list, verifying that all subdomains, wildcard patterns (e.g. *.example.com), and multi-domain hostnames are accurately listed.

Auditing Mixed Content and Insecure Third-Party Resources

A secure HTTPS website can be compromised if individual subresources (such as images, scripts, stylesheets, or fonts) are loaded over unencrypted HTTP connections. This triggers mixed-content warnings or complete blocking by WebKit.

To detect mixed-content violations in Safari Web Inspector:

1. In the Network tab, filter requests by typing http:// in the search bar.
2. Look for requests flagged with a yellow warning or red exclamation badge.
3. Switch to the Console tab to view detailed WebKit security warnings:

   [Blocked] The page at https://example.com was not allowed to display insecure content from http://cdn.example.com/asset.js.

4. Update all insecure resource URLs to use protocol-relative paths (//cdn.example.com/) or explicit HTTPS URLs (https://cdn.example.com/).

Diagnosing Certificate Errors and Untrusted Handshakes

When developing locally using self-signed certificates or internal enterprise CAs, Safari displays “This Connection Is Not Private”. Use Web Inspector and macOS Console to diagnose the root cause:

• Missing SAN in Self-Signed Certificates: Safari on macOS strictly rejects certificates that lack subjectAltName extensions containing DNS:localhost or the local IP address, even if the certificate is manually trusted in Keychain Access.
• Weak Signature Algorithms: Certificates signed with outdated hash functions (such as SHA-1 or MD5) are blocked immediately by macOS Security framework. Ensure all certificates use SHA-256 or higher.
• Missing Intermediate Certificates: If a web server fails to bundle intermediate certificates in its SSL configuration (e.g. fullchain.pem), Safari may show an untrusted warning while other browsers succeed due to local intermediate caching. Web Inspector surfaces the missing intermediate gap immediately in the trust hierarchy view.