I want to check, from the command line, if a certificate is already imported in the KeyChain in order to avoid doing a sudo security add-trusted-cert ... if that's not necessarily.

I already have the certificate on disk but I don't know how it verify if it already installed in the KeyChain or not.

  • 1
    There is a find-certificate option, does this help? – nohillside Dec 9 '16 at 12:39
  • I looked at it it it does not seem of much help because it can only search by name or email address, and not even the full CN name. This means that extracting the name using something linke ` openssl x509 -noout -subject -in Eng-CA.crt | sed -e 's/^subject.*CN=([^/]*).*$/\1/'` would give you name that is not unique enough for a search, I get something like "Engineering Services". I can also extract the hash from both the PEM certificate or to tell find-certificates to return it but I cannot search by it. – sorin Dec 9 '16 at 14:42
  • Perhaps you could grep the output of security export -k yourKeychain -t certs. Also see jamf.com/jamf-nation/discussions/20059/…. – Ohad Schneider Jan 12 '17 at 14:18

You must log in to answer this question.

Browse other questions tagged .