Need to select a certificate to login?

Question

Need to select a certificate to login?

Jeff Bell 0

When trying to login to my exchange email account, after entering the password for the account, I get a new message, “Select a certificate to sign in to [Moderator note: Personally Identifiable Information removed]@csuchico.edu”. Both com.apple certificates lead to a blank login window. This does not happen when logging in here, just when trying to login to my email

0 comments

2 answers

Your answer

Answer 1

Hi @Jeff Bell,

Based on your description, the certificates beginning with com.apple are unlikely to be the certificate required for your school account. Please do not modify or delete them.

Your school’s instructions indicate that Outlook for Mac should ask for your school email address and password, followed by Duo approval. Certificate selection is not part of the documented sign-in process.

Note: This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. We can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it.

First, please open a private or incognito browser window and try signing in to your school email account:

If you can sign in successfully with your password and Duo, this would help narrow the issue down to Legacy Outlook for Mac or its locally stored sign-in data.
If the browser also asks you to select a certificate, try another browser and network, and temporarily disconnect any VPN or proxy. This can help determine whether the certificate prompt is related to the browser, network, or device configuration.

If browser sign-in works normally, please update Outlook and macOS, then try using the current Outlook for Mac instead of Legacy Outlook. You may also remove the account from Outlook and add it again using your school’s setup instructions.

If the certificate prompt continues, please contact your school’s IT support team. They can verify whether your account or Mac requires an institution-issued certificate and check the school’s Duo and authentication configuration.

Answer 2

Do not select either com.apple certificate; ask CSU Chico IT whether this Exchange account requires client-certificate authentication and, if it does, have them identify or install the institution-issued certificate that must be selected.

Legacy Outlook for Mac supports client-certificate authentication for Exchange accounts, but the required client certificate must first be installed in the macOS Keychain.^1^ The fact that both Apple certificates produce a blank window does not establish that either one is appropriate.

Information to give CSU Chico IT

Report these exact details:

Outlook for Mac is using a csuchico.edu Exchange account.
The password is accepted, after which Outlook says “Select a certificate to sign in.”
Only two com.apple certificates appear.
Selecting either produces a blank sign-in window.
Ask whether a recent Conditional Access or certificate-authentication policy requires a university-issued client certificate.
If a certificate is required, ask IT to provide installation/enrollment instructions and confirm the certificate name expected in Keychain Access.
If no certificate is required, ask IT to review the account’s authentication policy and Outlook sign-in logs.

Because this is an organization-managed Exchange account, the university’s IT administrators control its authentication requirements and can reset or unlock the account if necessary.^2^

Optional: clear stale Outlook credentials

Use this only if CSU Chico IT confirms that client-certificate authentication is not required. Microsoft documents the following Keychain procedure for Outlook 2016 for Mac repeatedly prompting for authentication; it is a troubleshooting step for stale or duplicate authentication data, not a confirmed fix for this exact certificate prompt.^3^

Caution: This signs the account out of other Office applications that use modern authentication.

Quit Outlook and every other Office application.
Open Finder → Go → Utilities → Keychain Access, or search for Keychain Access with Spotlight.
Search for Exchange.
Inspect the Account field and delete only entries associated with the affected Exchange account.
Search for adal.
Delete entries whose type is MicrosoftOffice15_2_Data:ADAL:<GUID>.
Search for office.
Delete:
- Microsoft Office Identities Cache 2
- Microsoft Office Identities Settings 2
Quit Keychain Access and reopen Outlook.

Outlook should request authentication again. If the certificate prompt returns, stop selecting the Apple certificates and send the result to CSU Chico IT.

Re-create the account only where it is configured

If the account is configured through macOS: Open System Settings → Internet Accounts, select the Exchange account, choose Delete Account, restart the Mac, then return to Internet Accounts → Add Account → Exchange and sign in again.^2^
If it exists only inside Outlook: Remove and re-add it through Outlook’s account settings using the university-supported Microsoft/Exchange sign-in process rather than changing Internet Accounts.

If browser-based Outlook works while Legacy Outlook continues displaying the certificate prompt, use webmail temporarily and include that distinction in the IT request.

References