27

I am getting "Unknown Error = -2,147,414,007" on creating a certificate through the Keychain app.

Unknown Error = -2,147,414,007

Steps to Recreate:

  1. Open the Keychain Access application. Select Certificate Assistant > Create a Certificate in the application menu (Keychain Access). Only Modified Parameters are listed. The remaining options are kept with default values.

    Name of Certificate = gdbcert
    Identity Type = Self Signed Root
    Certificate Type = Code Signing

  2. Check the Let me override defaults checkbox, and click Continue.

  3. On the next page, leave Security Number to be 1, and set Validity Period to 3650.
  4. Then click Continue once again, and keep doing so to skip the next six screens until you see the one entitled Specify a Location For The Certificate.
  5. For the only property, Keychain, choose System from the drop-down list. Lastly, click Create, type in your password, if prompted, and click Done.

Update: I'm able to create certificates to the Login Keychain. The issue is only when I try to create certificates for the System Keychain.

  • Can you achieve what you need to do? Have you reported this directly to Apple via bugreporter or their feedback page? – Graham Miln Dec 15 '17 at 15:58
  • I have posted in Apple Support Forums. And yes, I was able to get gdb to work. The steps are listed in the Answers section. – Danis Fermi Dec 15 '17 at 16:15
  • Please can you report this reproducible bug directly to Apple. Apple engineers do not read the support forums or Ask Different. The best means for telling Apple is through their bugreporter site. – Graham Miln Dec 15 '17 at 17:06
  • Duplicate of apple.stackexchange.com/questions/302866 – Graham Miln Dec 15 '17 at 17:07
  • Got the same error but when I ran certificate assistant the second time and use the same name, it created the certificate for me immediately with no further step... – カオナシ Dec 5 '18 at 21:58
17

Was able to get this to work. The purpose for creating a certificate was to codesign gdb on Mac. Here are the steps for the same:-

  • Create a certificate with all the parameters mentioned above.
  • Instead of saving the Keychain under location System, save it under Login.
  • Then, unlock the System Keychain by clicking on the lock icon on the top left corner and drag the certificate from Login to System.
  • Right Click the Certificate, click on Get Info and and under Trust, set to Always Trust.
  • Restart taskgated in terminal: killall taskgated
  • Enable root account:
    Open System Preferences.
    Go to User & Groups > Unlock.
    Login Options > "Join" (next to Network Account Server).
    Click "Open Directory Utility".
    Go up to Edit > Enable Root User.
  • Run codesign -fs gdbc /usr/local/bin/gdb in the terminal.
  • Disable Root Account again and you should be good to go.

Credits:

  • 1
    by the way, what is the purpose of enabling the root user? The instructions here don't say to actually log in to the root user. Additionally, the answer in the other thread did not include that root user step. – xdavidliu Mar 13 '18 at 0:26
  • i got this to work. Using latest High Sierra, plus gdb 8.01, not 8.1, due to the issue discussed elsewhere. Additionally, I had to do sudo /usr/sbin/DevToolsSecurity --enable, as discussed in another topic, in order to prevent an pop-up password prompt when I run gdb. – xdavidliu Mar 13 '18 at 0:50
  • Dragging did not work -- it froze with the drag cursor, and the Keychain App GUI was lagging. I ended up right click, copy, then got to System and right click and "paste 2 items". – alexei Jan 25 at 0:23
  • When I did "killall taskgated" I got "No matching processes belonging to you were found". "sudo killall taskgated" did work. – Bruno Rijsman Apr 1 at 16:57
  • @xdavidliu I work fine for me when I skipped the "Enable root" and "Disable root" steps. When I ran codesign I got a pop-up asking for my password. – Bruno Rijsman Apr 1 at 17:13
1

My workaround was a little bit different. I checked the option "Let me specify key pair information" and went with what was selected by default. Key size was 2048 bits and Algorithm was RSA. That seemed to let me get around the "Unknown Error = -2,147,414,007".

  • I don't think this is correct: there is no option with the name "Let me specify key pair information". The only option that is similar is "Let me override defaults", and everyone encountering this problem is already selecting that. – xdavidliu Mar 12 '18 at 23:39
  • Not sure what OSX you are using, but I'm seeing the option on High Sierra. – atodTechies Mar 20 '18 at 2:04
0

Before you create a certificate, you should unlock the lock on System. In this case, you won't get that error.

  • this answer does not work at all. I just confirmed a minute ago on High Sierra. You still get the same error. – xdavidliu Mar 12 '18 at 23:36
0

I received this error on one of my users computers after he updated to Mojave against my suggestions.

The end result for the certificate issue was keeping my user from connecting to our employee wifi.

I followed Danis's instructions from 12/15/17 but the terminal commands didn't work and my company uses a certificate from a CA server, so the details were a little different. I did enable the root user though.

Finally I deleted our employee wifi out of the network settings, manually rejoined the Employee wifi and changed the security settings back to EAP-TLS, choosing the correct certificate, and it connected.

I wish I had recorded my steps better for this but I'm assuming Apple updated some of their network security and it was the wifi connection settings that actually did the trick.

0

Disclaimer: Keychain Access is rarely behaving as expected.

Admittedly, the following answer is a workaround as it creates both a CSR and a new set of associated keys.

  1. Launch Keychain Access, unlock it, select Login (but do not select anything else)

    Keychain Access unlocked

  2. In the Keychain Access menu
    Certificate Assistant ▶︎ Request a Certificate From a Certificate Authority...

    Request a Certificate From a Certificate Authority

  3. Pick the email address to be associated with both the CSR and the key pair.

    • The key pair will be named in Keychain Access according to the Common Name
    • Tick Let me specify the key pair information (which you will do in a subsequent dialog)
      Let me specify the key pair information
  4. Save the Certificate Signing request

    Save CSR

  5. Specify key size & algorithm RSA 2048 bits

    RSA 2048 bits

  6. Check your new set of keys in Keychain Access Notice that the Login section now contains a new pair...

    New key pair

...and that you didn't encounter the “Unknown Error = -2,147,414,007” on creating certificate with Certificate Assistant.

0

This is what I do:

Uncheck the Let me override defaults checkbox

and then it works fine.

I'm using High Sierra 10.13.6 (17G7024).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .