Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my system when I check Keychain Access I often find new certificates. They get put there behind the scenes. Is that normal? When does this happen? Is there a way I can get alerted when a certificate gets added to the keychain?

share|improve this question
    
In your login keychain, or the system keychain, or some other keychain? Could you name a recent example that you have noticed? – Harald Hanche-Olsen Jun 3 '12 at 9:56
    
Do you have any kind of work-related enterprise configuration profiles? Or have you ever installed a configuration profile? Better yet—are there any configurations profiles installed? Check System Preferences -> Profiles and let us know if there's anything you didn't expect there. – samh Feb 5 at 20:27

Apple may occasionally approve additions to new Root CAs e.g. Verisign, who can then sign certificates for individual sites you visit.

The root certificates for OS X El Capitan are here https://support.apple.com/en-us/HT205204

I assume these are done in software updates via the App Store, but I don't know for sure.

Also your company may add additional self signed certificates for internal reasons or installing development software.

But AFAIK keychain won't bloat over time as you visit new sites, so the list should be fairly static.

share|improve this answer

If you get signed and or encrypted email from folks who use SMIME, Mail.app will helpfully add their public x509 certificates to your login keychain.

A pretty good explanation of the process can be found at Secure emails with Apple Mail

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.