I have a certificate in my keychain, and i need to see when did i introduce it. I can't seem to find a way to so. The properties of the certificates don't include that. Is there a log of keychain events somewhere that could help or anything?


  • What time period might the certificate have been imported – days ago, months ago? Do you have Time Machine back-ups for this time period? – Graham Miln Apr 30 '14 at 10:46
  • no higher precision? No i don't have Time Machine ON, it's OFF – LolaRun Apr 30 '14 at 10:54
  • I wondered if searching through Time Machine keychains would be possible. It is not in this case. – Graham Miln Apr 30 '14 at 11:09

Keychain Dump

There is no automatic history of the Keychain kept on Mac OS X. You can see everything stored within a keychain file using the following command:

security dump-keychain ~/Library/Keychains/login.keychain


A rotating log of authentication related actions is kept. This may have logged the granting of rights needed to import the certificate. It is unlikely but the only place Mac OS X, by default, logs authorization and authentication related activity.

You can see the log using Console.app within the /var/log/authd.log range of files.

  • Thanks, but none proved useful – LolaRun May 6 '14 at 6:54
  • So without regular back-ups, it appears there is no way to determine when the certificate was imported. – Graham Miln May 6 '14 at 9:57
  • so far, that what it seems – LolaRun May 6 '14 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .