After properly creating a valid certificate for code signing, when running the command:

$ codesign -s CertificateName AppPathName

I always get a:

CertificateName: no identity found

Anyways, When I open the Keychain Access I see that certificate created in the System folder (with a + circle over it).

Also, when I run:

$ security find-identity -p codesigning ~/Library/Keychains/System.keychain

The result is:

Policy: Code Signing
  Matching identities
     0 identities found

  Valid identities only
     0 valid identities found

What does this mean?

My console does not have access to the keychain? I also tried everything with sudo.

(I use zsh Terminal if that is important)


I've also found out that the System Keychain is locked, but unlocking it won't work and after performing a codesign action it goes back to "locked" again.

2 Answers 2


Late answer but maybe it will help someone in future: In first step of creating certificate select "Let me override defaults" and go farther to "Extended Key Usage Extension" (Code Signing needs to be selected)

enter image description here


This is not the explanation of the problem but the way I worked around to solve it:

  • Deleted the previously created certificates.
  • Unlocked the System keychain with the keychain Access tool (locker on the left).
  • Recreated the certificates filling most of the fields of information even if not totally required.
  • Switched to a simple and clean terminal (just in case a modified terminal lacked some kind of access to the keychain)
  • Executed the codesigning commands with sudo

This worked for me, but I don't really understand what was causing the problem previously.

  • Debugging the chain of trust is super hard, it's not wrong to remove the keys and make new ones in order in case one intermediate cert has expired, been locked or moved/corrupted.
    – bmike
    Commented Apr 30, 2019 at 11:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .