Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I am trying to add myRepositoryKey to my Mac keychain utility so . I exported this item in OpenRSA format from Putty. When I try to use Import Items, the file is unselectable. What do I need to do to import into my keychain? Does the file need a specific extension?

share|improve this question

3 Answers 3

up vote 15 down vote accepted

You have to create a .p12 file. In order to do that you need your private key and a certificate for that key. Then run the following on your console:

openssl pkcs12 -export -clcerts -inkey private.key -in certificate.crt -out MyPKCS12.p12 -name "Your Name"

where private.key is your existing private RSA key, certificate.crt is your existing certificate and MyPKCS12.p12 is the name of the file to create. This file can then be imported into your keychain.

If you need your key for SSH access (SFTP, SCP or similar), it doesn't have to be in your keychain. Simply copy your private key to ~/.ssh/ and edit/create the ~/.ssh/config file. There you would put something along these lines:

# replace the host, location of the private key and the remoteUserName
# with valid values.
Host remote.domain.com
    IdentityFile ~/.ssh/private.key
    User remoteUserName
share|improve this answer
What do you mean by a certificate for the key? Would I have to involve a signing authority? –  Casebash Feb 23 '11 at 20:24
Yes, or sign one yourself, although I would not recommend that for anything else than personal use. –  bummzack Feb 23 '11 at 22:36
Just an FYI, the command worked for me using a .pem rather than a .crt for the certificate. I first tried to convert the .pem to a .crt, which failed, then just tried the .pem in the command you've shown directly and that actually worked! –  quickshiftin Oct 16 '13 at 17:19
it did create p12 file in my case but with this error "unable to load certificates" what does that mean? –  Neutralizer Nov 8 '13 at 22:13

Well I don't get that "need a certificate for the key" either...

I just do ssh-add -K /path/to/private/key.

However, make sure you're using Mac's built-in ssh-add and not Macports' one (if you ever needed to upgrade OpenSSH).

So, just do /usr/bin/ssh-add -K /path/to/private/key.

Hope that helps.

share|improve this answer
Correct: the built-in SSH must add the key, then both the built-in SSH and the MacPorts SSH can use it. –  Nerdling Sep 28 '11 at 18:11

I've tried to import a .p12 using Keychain's GUI just to be silently ignored under Lion. So just for completeness, I'd like to this post in Stephan's Blog


In short, this should do the trick every time:

security import priv_key.p12 -k ~/Library/Keychains/login.keychain
security import pub_key.pem -k ~/Library/Keychains/login.keychain
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.