4

In the folder “Keychains” in my Library folder (~/Library/Keychains), I have a file “login.keychain” and a file “login.keychain-db”. Is the file “login.keychain” still being used in macOS Sierra, or is it safe to delete it?

I have a few other keychains with pairs of these files “name.keychain” and “name.keychain-db”. But when I create a new keychain in Keychain Access, there’s only a file “name.keychain-db”. Based on this and the modification times of the files, I’m guessing Sierra only uses the new files (“name.keychain-db”), but that the upgrade left the old files (“name.keychain”) in place as a backup? So it should be safe to remove the old files?

  • Have you tried renaming the files or moving them to a different folder and checking if you can still access them in Keychain? – בנימן הגלילי Feb 19 '17 at 9:40
  • In macOS 10.11.1 High Sierra I have just transferred a name.keychain-db file from a different machine (10.12 Sierra) and added it into the keychain app. This did NOT create a corresponding new name.keychain file. All the data appeared OK. Secondly I transferred a name.keychain file without the corresponding name.keychain-db file, and the contents of that keychain appeared out of date. I infer that the name.keychain-db file is the important one. But I would not delete the .keychain file without further testing – Mic Channel Dec 6 '17 at 19:56
1

Yes, the .keychain files are the old format.

.keychain-db is the new format.

Modify a key in Keychain access and observe the modification dates. I deleted those files years ago without issue.

0

Using OS 10.12.6 Sierra on a MacBook Pro 2016

I would not delete either database without confirming that the contents are identical, then keeping a copy elsewhere, as mentioned above, if you experiment.

I found 2 databases in my system library that appear to represent my full database: login.keychain and login.keychain-db. These names do not match the Keychain List item names in the top L corner area within Keychain Access (hover over the keychain name to see the System library database to which that Keychain correspond), which makes things more confusing.

The 2 Keychains are not identical (check the number of items at the bottom of the KA screen). It appears that the smaller of the 2 databases contains earlier versions of items that may or may not have been updated. In any case, if you select a database from the Keychains list, you can sort it by Date Modified in the KA window. Compare this with the other Keychains in your list sorted by Date Modified. In my case, the date modified range of one keychain is cut off at a certain date, while the date modified range in the other keychain continues to the date of my last entry.

This makes me want to assume that I could delete the database that has the earlier Date Modified cutoff date. If I search for an item that has been created before and modified after that cutoff date, it shows up in search results as a separate item.

Somehow, at sometime the OS separated my Keychain Access database into 2 visible databases that are really part of the same database at a lower level(see Apple Support info below). The active database appears to be the one with -db in the System Library name.

The Date Modified cutoff date on the older database is on or near the date of my upgrade to Sierra (on my new computer) from my old OS 10.6.8 on my old computer. However, I don't recall noticing data in 2 databases or receiving duplicated search results prior to re-installing my Sierra system and the last update patch.

The frustration is that when I search or browse, I might inadvertently access older information (or none at all or end up recreating an item). Until this is better explained, I would a) Hang on to a copy of all databases outside the System Library and b)be very careful about comparing information in the 2 databases if both are left in the System. I might (but have not yet) experiment with preserving a copy of the older database outside the System Library, removing it from the active System and see what I am left with.

Assuming the above, merging keychains would not be a good idea, since older versions of items might either replace or live alongside the newer versions.

FYI for those dealing with the above issue or wanting to merge/export keychains or keychain items for other reasons (in my case, I also had items missing entirely):

I called Apple Support and spoke with a Sr Advisor. The above scenario was a mystery to him. He also had the mistaken idea that Keychain Access allows export and import of items using the File Menu commands. (This is not true--Export remains greyed out no matter what or how much is selected. He will report this to Apple Engineers along with the evidence of 2 separate databases in KA).

He also thought that I could simply select an item and drag it to another keychain (in my scenario above, this does not work because KA thinks the item already exists and won't transfer it--the databases are linked at a lower level).

We also tried copying an item to the clipboard and pasting. This resulted in copying only the contents of the item with no way to import except by creating new empty containers in KA.

So, as of this moment, there is no way to merge keychain items, only recreate them. There are a few online posts that indicate that AppleScript commands might accomplish this, but it is more complex a process that I am ready to risk my OS on.

If anyone has a legitimate, confirmed by Apple, resolution to any of this or further legit explanation, please post it.

Until then, please call Apple with your issue so there is a substantial record in their database.

UPDATE: I tried removing the database with the earlier Date Modified cutoff and all seems OK.....but be careful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .