Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Starting fresh install of OS X Server on running Mountain Lion after having saved the private key, intermediate and public certificates on another computer.

Now I want to replace the key and certs generated by Server app setup for new incarnation of with the CA-signed ones I backed up previously.

Using Keychain Access app - started from command line sudo when both exporting and importing - imports cert but not key. I don't really want to spend another £35 on a new CA-signed cert relating to new private key.

Key and certs all show in own keychain on backup machine.

  • Exported them as .crt file(should have exported as .p12 perhaps?);
  • sent .crt file to freshly setup server;
  • imported into system keychain before Server app setup to test process / avoid clash with generated key and self-signed cert;
  • opening .crt file imports signed cert but not key.

Answer: will create answer when allowed by stackexchange in a few hours

It worked after:

  • exporting key and certificate in .p12 file from the backup m/c's keychain - instead of .crt file
  • importing the .p12 file from the server's Keychain Access app (started from sudo command line sudo /Applications/Utilities/Keychain\\ Access - instead of opening / double-clicking file in Finder (of administrator but not root)

Whether both or one of the above is required I don't know. However we now have original server's private key and related signed certificate.

Next question ... how to avoid this being overridden by Server app setup ... but that's another question!

share|improve this question
Thanks this helped get me on track. Rather then opening keychain access from terminal with sudo, I believe you can import the certs normally and just make sure it is selected to go into the system keychain rather then the login keychain. That seemed to work for me and I imagine that by starting it with sudo it is probably just opening keychain access with no login keychain forcing everything into system. – Nick Dancer Mar 20 '13 at 1:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.