I want to check, from the command line, if a certificate is already imported in the KeyChain in order to avoid doing a sudo security add-trusted-cert ... if that's not necessarily.

I already have the certificate on disk but I don't know how it verify if it already installed in the KeyChain or not.

  • 1
    There is a find-certificate option, does this help? – nohillside Dec 9 '16 at 12:39
  • I looked at it it it does not seem of much help because it can only search by name or email address, and not even the full CN name. This means that extracting the name using something linke ` openssl x509 -noout -subject -in Eng-CA.crt | sed -e 's/^subject.*CN=([^/]*).*$/\1/'` would give you name that is not unique enough for a search, I get something like "Engineering Services". I can also extract the hash from both the PEM certificate or to tell find-certificates to return it but I cannot search by it. – sorin Dec 9 '16 at 14:42
  • Perhaps you could grep the output of security export -k yourKeychain -t certs. Also see jamf.com/jamf-nation/discussions/20059/…. – Ohad Schneider Jan 12 '17 at 14:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.