6

I recently moved computers, and since then I can no longer import certificates into my login keychain. I have:

  • Tried using Keychain First aid
  • Tried running reset password in recovery mode to reset permissions
  • Tried running disk first aid and resetting permissions

None of these have helped. I still get [UNIX]Permission Denied when I try to import.

So I tried a few other experiments:

  • I tried deleting old passwords from the keychain. that worked fine
  • I made a new keychain, development, and imported the certificate there. that worked fine too.

So for whatever reason, something is wrong with my login keychain. Is there a way to export everything and re-import into a new copy? I looked on the Apple web site, but it's hopelessly out of date.

Improve this question
1
  • There's a small chance that if you're experiencing the same issue, your certificates are actually importing, but are showing up under a different name than you expect. Double check and you may find this is the case! – Brad Parks Jan 16 '19 at 17:53
2

I hope this helps someone in the future:

The list of keychains, notably login.keychain, is stored in ~/Library/Preferences/com.apple.security.plist

The system.keychain and similar are found in /Library/Preferences/com.apple.security.plist

If those files have wonky permissions, you'll have problems doing anything. Even if the keychain files themselves are fine, if the OS is unable to edit those two files it just silently fails in weird ways. Notably, Keychain Access will keep forgetting about the whole login chain, and anything you add or remove from it.

This same problem may apply to the keychain itself; if you can't save to it, you likely have wonky permissions.

Note that it appears Disk Utility does not fix this, although I don't know why. It seems you have to manually fix this. You can do this by doing a Get Info on a root folder and reapplying permissions. In my case the problem was that the Owner was wrong because I moved the files from another machine.

Improve this answer
2
  • 3
    After speaking the head of Mac support at Apple, he had everything fixed in a couple of minutes. Look at any older file in your account and Get Info. In the security section, is there a "custom"? If so, select your root user folder, get info, add admin readonly, you read/write and everyone read only, then click the gear and apply to all enclosed. Fixed. Disk Util should do this for you, but doesn't. – Maury Markowitz Aug 15 '14 at 13:42
  • Works perfectly as mentioned. Saved my day. :) Tons of thanks! :) :) – Pratik Somaiya Aug 23 '16 at 5:48
0

Create a new login keychain and copy the contents of the old keychain into the new.

  1. Close Keychain Access. Open Terminal and make a backup of your login keychain.

    cp ~/Library/Keychains/login.keychain{,-old}

    • You now have two keychains in your keychain folder named login.keychain and login.keychain-old. The latter is an identical copy of the original keychain.

  2. Move login.keychain to your desktop and rename it with the following command:

    mv ~/Library/Keychains/login.keychain ~/Desktop/login1.keychain

  3. Now, create a new, empty login keychain:

    touch ~/Library/Keychains/login.keychain

  4. Exit Terminal. Open Keychain Access. The login keychain will be empty.

  5. On your Desktop, double click login1.keychain

  6. Within Keychain Access, unlock login1.keychain and copy all of its contents into the new, empty login.keychain

  7. Right click (or Control + click) login1.keychain and select "Delete References and Files"

  8. Attempt to import your certificates.

Improve this answer
11
  • Ok, I've done this and I have the certs in the keychain. Yay! Here's the remaining issue: when I quit Keychain Access and re-open it, the login keychain is missing. It still works, apps save passwords properly (it seems), but its never in the list. I suspect this list is locked? Where is this list stored? – Maury Markowitz Jun 12 '14 at 11:19
  • @MauryMarkowitz in Keychain access, once you open in, right click in the side bar. Are you presented with the option "Make login keychain default"? If so, click it and test. I would also suggest running keychain first aid again. If still it won't show up, from menu bar in Keychain Access > Edit > Keychain List > Show: User > click the + sign and add the login keychain path – njboot Jun 12 '14 at 18:13
  • My apologies if this dups. When I open keychain access, login is not there. So I go to the keychain list, press + and select it. It appears in the list in the main window, and is bold as the default. This is why I think the problem is not the keychain but the file where keychain access saves this list. – Maury Markowitz Jun 12 '14 at 21:56
  • That said, I can't save my iCloud password. Everything else seems fine. – Maury Markowitz Jun 12 '14 at 21:57
  • @MauryMarkowitz You are referring to this list, correct? I would try resetting the login keychain through keychain access itself if you're still having trouble. Keychain Access > Preferences > General > Reset My Default Keychain. Then, import contents from the old into the new. In retrospect, this is a better method. – njboot Jun 12 '14 at 22:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .