I've only recently upgraded to Mavericks and hence I'm not entirely sure whether this is a Mavericks only problem or not, but here it is:

Security update 2006-007 apparently broke 8192-bit certificates on OS X and no one bothered to fix it (https://discussions.apple.com/message/3650856#3650856). However there is (or rather used to be) a solution for this bug (or feature?) and it is in https://discussions.apple.com/thread/2668985 You've just got to execute

sudo defaults write /Library/Preferences/com.apple.crypto RSAMaxKeySize -int 8192

in a Terminal prompt. Well I did, then I also restarted my macbook. However this had no effect other than setting the RSAMaxKeySize. Here is how I know the defaults command worked:

ingenious@book ~  $ sudo defaults read /Library/Preferences/com.apple.crypto  RSAMaxKeySize

However trying to import a (valid!) 8192-bit self-signed certificate into my system keychain (using Keychain Access) I keep getting the following error:

Error: -67762

So, can anyone confirm this in 10.8.*? Is there any alternative way to make 8192-bit certificates work on OS X?

Edit: Could this thing actually be related to the new openssl in 10.9? (http://curl.haxx.se/mail/archive-2013-10/0036.html)

migrated from stackoverflow.com Nov 12 '13 at 2:03

This question came from our site for professional and enthusiast programmers.


The answer, as discovered by shizmob, is that Apple moved the location of this preference in Maverics to /Library/Preferences/com.apple.security. So what you need to run is

sudo defaults write /Library/Preferences/com.apple.security RSAMaxKeySize -int 8192
  • that certainly did the trick, thanks for answering :) – ingenious Nov 20 '13 at 20:34
  • You're welcome. I’m always not quite sure whether I should “steal” other people’s solutions. I don’t even own a mac and only discovered this question because shizmob linked to it in his blog post (but didn't answer it). But if my post actually helped you solve your problem, I guess I did good ^^. – Chronial Nov 21 '13 at 1:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.