I'am trying to fully automate the process FileVault setup on multiple OS X user machines.
E.g. to have a Bash script as a result.
One of the steps is Institutional Recovery Key (IRK) generation. This key is required to access encrypted hard disk without user credentials.
The generation command sudo security create-filevaultmaster-keychain create a public-private key pair.

But only the public one must be installed on the user machine.
I can delete it using Keychain Access utility.
But this is a GUI utility and cannot be called from the Bash.

So, how can i remove the private key from the keychain-file from the command line?

Or maybe there are already working scripts for this task :)

P.S. I've already read this but find no answer:
IRK management
security command man

  • You may have missed something in the IRK management link. Have a look at: fdesetup(8) Oct 24, 2016 at 11:59
  • What exactly i've missed here? Sorry, i'm newbie in Mac and FileVault :( Oct 24, 2016 at 14:23
  • Did you go back and reread the article and read the man page for fdesetup(8)? Oct 24, 2016 at 14:24
  • Hmm, do you suggest ` fdesetup enable -certificate mycertfile.cer` option? and CER-file can be created using sudo security create-filevaultmaster-keychain? Oct 25, 2016 at 9:11

2 Answers 2


I haven't tried recovering data with it yet but I think the following works:

security create-filevaultmaster-keychain ~/Desktop/FileVaultMaster.keychain

security export -k ~/Desktop/FileVaultMaster.keychain -t certs -o ~/Desktop/FileVaultMasterPublic.cer

sudo fdesetup changerecovery -institutional -certificate ~/Desktop/FileVaultMasterPublic.cer

In my case FileVault was already enabled so I just added it after the fact.

  • Nice solution - just export certificate for further using! However, looks like there is no tool to remove private key... Oct 27, 2016 at 14:10

Type "man fdesetup" in the terminal app on your mac. Read the document.

  • 3
    Telling people to RTFM might be considered rude or at least not very helpful, especially for a Mac newbie. Can you at least indicate which part/option the OP should look at (or even cite it in your answer)?
    – nohillside
    Oct 25, 2016 at 6:12
  • @patrix Thanks for support! Looks like i should use -certificate option. However i must understand that a certificate Apple means first Oct 25, 2016 at 9:12
  • I didn't use the term RTFM but I sincerely hope you were not offended@BughunterExtreme If you were, my humble apologies.
    – Tunes
    Mar 10, 2017 at 7:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .