Cyberduck says they were taking a certificate offered by the server Amazon S3, in this case. I also don’t understand the root cause of the problem. We now have a bug report on file, my report text below. I’m not sure the Cyberduck authors understand the magnitude of the problem though, or that users of old versions now have broken Macs. There was a reported and fixed bug in Cyberduck. Version 4.7 (17432) is the latest version of Cyberduck. It doesn’t cause the problem any more.

(For completeness I should add Cyberduck also complains about an SSL hostname mismatch when connecting to S3, but I think that’s a legitimate and expected error and unrelated to the Verisign certs.) I also manually verified the login keychain entries show up again as soon as I run Cyberduck after deleting them. It’s just the right kind of unusual application that would cause a bug like this that some small group of users on the Internet finds but not everyone.Ĭyberduck 4.6.3 placed a bunch of errors in the console, including the smoking gun “4/27/15 3:42:05.621 PM Cyberduck: Error adding certificate to Keychain”. I use it sporadically to browse S3 buckets.

The system Console helped me narrow it down to the application Cyberduck, version 4.6.3. I figured out what put the rogue SSL certificate on my system, the one that breaks MacOS Mavericks.

Cyberduck s3 not working