I'm trying to clean up my mac a bit and therefore always check through logs to see what maybe unexpected or otherwise strange. This time I see way too much going on in the logs in terms of lines per second and one thing that catches my eyes quickly is these CSSM exceptions. Here's an example:

Standard    19:46:21.455829 +0100   syncdefaultsd   CSSM Exception: -2147411889 CSSMERR_CL_UNKNOWN_TAG

In this case it's from syncdefaultsd but they happen to be from differenct processes every few seconds. I've also seen them from com.apple.iCloudHelper, quicklookd, mdworker, launchservicesd and other macOS native services.

I found through google that some people posted about them already but didn't get a real answer. Thought I might find someone to help here.

Within Minutes i get thousands of these (just captured 10 minutes with nearly 9000 lines of CSSM Exceptions.


I have found these errors to relate to old keychain data references. I was able to stop most of these CSSM Exceptions from appearing by opening Keychain Access and deleting any empty keychains.

Agreed- my CSSM Exception errors went away when I got rid of some defunct Adobe Air keychain references. The references were particularly defunct, as I had recently deleted the files to which they referred, to get rid of a previous slew of log messages...!

Interestingly, Keychain Access did not immediately disappear the keychains when I asked it to delete them; I deleted them (I tried both "Reference only", and "Reference and Files" (even though I'd manually deleted the files...!)), and they remained visible. So I quit and reopened Keychain Access- and they were gone :-) And so were the CSSM log messages :-)

  • …but it still provides useful information so I hope it doesn't simply vanish. An answer to the question would be "check Keychain Access for keychains related to apps you don't have installed anymore and remove them". – dipnlik Jan 31 '17 at 18:04

This is basically an encryption / validation error. Even thousands of these is not a problem to be solved if you don’t need that specific software calls to be validated for an app to function properly. These can just be safely ignored and logged for most people.

In your case, I would narrow down when the syncdefaultsd is having problems by disconnecting from all networks. If it's stuck, you might restart the OS when disconnected from the network and convince yourself that you are not seeing thousands of messages.

It's not going to be a significant error load on the system to log messages - it's clearly taking some processing - but I doubt anything less than a million lines a day would be measurable on a portable.

As to the direct cause - the iCloud servers to which you are syncing defaults could be messed up or it could be a more local problem where one daemon is passing traffic in a secured / encrypted manner to another subsystem. If you're into code - here are some relevant portions with your specific error flag CSSMERR_CL_UNKNOWN_TAG:

Or you could look at how you are using x509 certs or contact Apple Support for some triage on the error. It might be harmless, it might be a bug, it might be a situation where you are on a compromised or malicious network in that an employer or someone is MITM your traffic.


I have found these errors to relate to old keychain data references. I was able to stop most of these CSSM Exceptions from appearing by opening Keychain Access and deleting any empty keychains.

  • 1
    What is an 'empty keychain'. Do you mean on the left hand side of the keychain access window, where there are entries for login/local items etc, you've got additional ones that are totally empty? Or do you mean something else? – Paul Hargreaves Jan 6 '17 at 7:22
  • I have the same question - I see a couple of references here, but I don't know what "empty keychain" means. Down below, @Lei Wang says "at the same level as login, Local Items, System, and System Roots", but the only thing I had there was something for Microsoft Intermediate Certificates. I deleted that, but the messages remain. – Michael H. Mar 25 '17 at 2:13
  • I had one empty one called Microsoft_Intermediate_Certificates but deleted it and didn't stop the error being output and Safari is still taking 3 secs to load a new page. Did you reboot? – malhal Oct 12 '17 at 11:14

I got the same CSSM problems and have solved them by opening the Keychain Access App and removing the empty entry in the Keychains pane (in the same level of "login", "Local Items", "System", and "System Roots").

P.S. My error message in Console is: CSSM Exception: -2147413737 CSSMERR_DL_DATASTORE_DOESNOT_EXIST


Unfortunately I don't have empty keychains nor orphaned keychains. But what I have is this: CSSMERR_DL_DATASTORE_DOESNOT_EXIST … ¯_(⊙︿⊙)_/¯ so it must be something else.

I copied my keychains various times so it might be very probable that there are corrupted or outdated keychain entries. But I don't see a way to figure out which are triggering the error :-/

I just wanted to let that stay here :-)


I was having the following error with the accountsd process:


This started with Mojave and continued with a brand new installation on a new laptop with Catalina.

What was happening is that Mail.app and accountsd process would both utilize a seriously high CPU percentage, to the point that I had to quit or force quite the Mail app to get the CPU back to normal. This was happening several times a day, which was obviously frustrating.

I found this thread and deleted a keychain that was empty that I had imported from a previous laptop.

I believe that what happened was that I imported the keychain from a previous laptop, then I enabled keychain synching in the Apple ID/iCloud settings in preferences. This must have copied all of the entries from the additional keychain to the iCloud keychain, leaving the imported one empty.

Once I deleted the imported keychain, which was empty and then closed and re-opened keychain access to verify that it had been deleted, I didn't have any more problems with excessive CPU utilization from Mail and accountsd and then error message in the consoel relating to CSSMERR_DL_DATASTORE_DOESNOT_EXIST disappeared.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .