Need to select a certificate to login?

Do not select either com.apple certificate; ask CSU Chico IT whether this Exchange account requires client-certificate authentication and, if it does, have them identify or install the institution-issued certificate that must be selected.

Legacy Outlook for Mac supports client-certificate authentication for Exchange accounts, but the required client certificate must first be installed in the macOS Keychain.^1^ The fact that both Apple certificates produce a blank window does not establish that either one is appropriate.

Information to give CSU Chico IT

Report these exact details:

• Outlook for Mac is using a csuchico.edu Exchange account.
• The password is accepted, after which Outlook says “Select a certificate to sign in.”
• Only two com.apple certificates appear.
• Selecting either produces a blank sign-in window.
• Ask whether a recent Conditional Access or certificate-authentication policy requires a university-issued client certificate.
• If a certificate is required, ask IT to provide installation/enrollment instructions and confirm the certificate name expected in Keychain Access.
• If no certificate is required, ask IT to review the account’s authentication policy and Outlook sign-in logs.

Because this is an organization-managed Exchange account, the university’s IT administrators control its authentication requirements and can reset or unlock the account if necessary.^2^

Optional: clear stale Outlook credentials

Use this only if CSU Chico IT confirms that client-certificate authentication is not required. Microsoft documents the following Keychain procedure for Outlook 2016 for Mac repeatedly prompting for authentication; it is a troubleshooting step for stale or duplicate authentication data, not a confirmed fix for this exact certificate prompt.^3^

Caution: This signs the account out of other Office applications that use modern authentication.

1. Quit Outlook and every other Office application.
2. Open Finder → Go → Utilities → Keychain Access, or search for Keychain Access with Spotlight.
3. Search for Exchange.
4. Inspect the Account field and delete only entries associated with the affected Exchange account.
5. Search for adal.
6. Delete entries whose type is MicrosoftOffice15_2_Data:ADAL:<GUID>.
7. Search for office.
8. Delete:
   • Microsoft Office Identities Cache 2
   • Microsoft Office Identities Settings 2
9. Quit Keychain Access and reopen Outlook.

Outlook should request authentication again. If the certificate prompt returns, stop selecting the Apple certificates and send the result to CSU Chico IT.

Re-create the account only where it is configured

• If the account is configured through macOS: Open System Settings → Internet Accounts, select the Exchange account, choose Delete Account, restart the Mac, then return to Internet Accounts → Add Account → Exchange and sign in again.^2^
• If it exists only inside Outlook: Remove and re-add it through Outlook’s account settings using the university-supported Microsoft/Exchange sign-in process rather than changing Internet Accounts.

If browser-based Outlook works while Legacy Outlook continues displaying the certificate prompt, use webmail temporarily and include that distinction in the IT request.

References

1. [Legacy Outlook for Mac](https://support.microsoft.com/outlook/send-a-digitally-signed-or-encrypted-message-for-mac#more-info-on-digital-signing,-encryption,-and-certificate-authentication)
2. Password issues locked out of Microsoft Exchange on MacOS14 - Microsoft Q&A
3. Outlook 2016 for Mac repeatedly prompts for authentication