I am getting "Unknown Error = -2,147,414,007" on creating a certificate through the Keychain app.

Unknown Error = -2,147,414,007

Steps to Recreate:

  1. Open the Keychain Access application. Select Certificate Assistant > Create a Certificate in the application menu (Keychain Access). Only Modified Parameters are listed. The remaining options are kept with default values.

    Name of Certificate = gdbcert
    Identity Type = Self Signed Root
    Certificate Type = Code Signing

  2. Check the Let me override defaults checkbox, and click Continue.

  3. On the next page, leave Security Number to be 1, and set Validity Period to 3650.

  4. Then click Continue once again, and keep doing so to skip the next six screens until you see the one entitled Specify a Location For The Certificate.

  5. For the only property, Keychain, choose System from the drop-down list. Lastly, click Create, type in your password, if prompted, and click Done.

Update: I'm able to create certificates to the Login Keychain. The issue is only when I try to create certificates for the System Keychain.

  • Can you achieve what you need to do? Have you reported this directly to Apple via bugreporter or their feedback page? Commented Dec 15, 2017 at 15:58
  • I have posted in Apple Support Forums. And yes, I was able to get gdb to work. The steps are listed in the Answers section. Commented Dec 15, 2017 at 16:15
  • Please can you report this reproducible bug directly to Apple. Apple engineers do not read the support forums or Ask Different. The best means for telling Apple is through their bugreporter site. Commented Dec 15, 2017 at 17:06
  • Duplicate of apple.stackexchange.com/questions/302866 Commented Dec 15, 2017 at 17:07
  • Got the same error but when I ran certificate assistant the second time and use the same name, it created the certificate for me immediately with no further step...
    – Max
    Commented Dec 5, 2018 at 21:58

7 Answers 7


Was able to get this to work. The purpose for creating a certificate was to codesign gdb on Mac. Here are the steps for the same:-

  • Create a certificate with all the parameters mentioned above.
  • Instead of saving the Keychain under location System, save it under Login.
  • Then, unlock the System Keychain by clicking on the lock icon on the top left corner and drag the certificate from Login to System.
  • Right Click the Certificate, click on Get Info and and under Trust, set to Always Trust.
  • Restart taskgated in terminal: killall taskgated
  • Enable root account:
    Open System Preferences.
    Go to User & Groups > Unlock.
    Login Options > "Join" (next to Network Account Server).
    Click "Open Directory Utility".
    Go up to Edit > Enable Root User.
  • Run codesign -fs gdbc /usr/local/bin/gdb in the terminal.
  • Disable Root Account again and you should be good to go.


  • 1
    by the way, what is the purpose of enabling the root user? The instructions here don't say to actually log in to the root user. Additionally, the answer in the other thread did not include that root user step.
    – xdavidliu
    Commented Mar 13, 2018 at 0:26
  • 3
    Dragging did not work -- it froze with the drag cursor, and the Keychain App GUI was lagging. I ended up right click, copy, then got to System and right click and "paste 2 items".
    – alexei
    Commented Jan 25, 2019 at 0:23
  • 3
    When I did "killall taskgated" I got "No matching processes belonging to you were found". "sudo killall taskgated" did work. Commented Apr 1, 2019 at 16:57
  • 3
    Excellent. A small nit. With respect to the step: Run codesign -fs gdbc /usr/local/bin/gdb in the terminal, what follows the flag -fs is the Name of the Certificate. It should be gdbcert to align with the SO's data given as part of the query.
    – Seshadri R
    Commented Jul 6, 2019 at 7:26
  • 1
    Performing all the steps in section 1 of sourceware.org/gdb/wiki/PermissionsDarwin resolved the issue for me on macOS Catalina (Version 10.15.4) for GDB 9.1. Commented Apr 13, 2020 at 12:02

My workaround was a little bit different. I checked the option "Let me specify key pair information" and went with what was selected by default. Key size was 2048 bits and Algorithm was RSA. That seemed to let me get around the "Unknown Error = -2,147,414,007".

  • I don't think this is correct: there is no option with the name "Let me specify key pair information". The only option that is similar is "Let me override defaults", and everyone encountering this problem is already selecting that.
    – xdavidliu
    Commented Mar 12, 2018 at 23:39
  • Not sure what OSX you are using, but I'm seeing the option on High Sierra. Commented Mar 20, 2018 at 2:04
  • Changing to RSA 4096 seemed to avoid that error. But I still can't get the OS to accept GDB's codesign. Commented Dec 18, 2019 at 23:16

I received this error on one of my users computers after he updated to Mojave against my suggestions.

The end result for the certificate issue was keeping my user from connecting to our employee wifi.

I followed Danis's instructions from 12/15/17 but the terminal commands didn't work and my company uses a certificate from a CA server, so the details were a little different. I did enable the root user though.

Finally I deleted our employee wifi out of the network settings, manually rejoined the Employee wifi and changed the security settings back to EAP-TLS, choosing the correct certificate, and it connected.

I wish I had recorded my steps better for this but I'm assuming Apple updated some of their network security and it was the wifi connection settings that actually did the trick.


Disclaimer: Keychain Access is rarely behaving as expected.

Admittedly, the following answer is a workaround as it creates both a CSR and a new set of associated keys.

  1. Launch Keychain Access, unlock it, select Login (but do not select anything else)

    Keychain Access unlocked

  2. In the Keychain Access menu
    Certificate Assistant ▶︎ Request a Certificate From a Certificate Authority...

    Request a Certificate From a Certificate Authority

  3. Pick the email address to be associated with both the CSR and the key pair.

    • The key pair will be named in Keychain Access according to the Common Name
    • Tick Let me specify the key pair information (which you will do in a subsequent dialog)
      Let me specify the key pair information
  4. Save the Certificate Signing request

    Save CSR

  5. Specify key size & algorithm RSA 2048 bits

    RSA 2048 bits

  6. Check your new set of keys in Keychain Access Notice that the Login section now contains a new pair...

    New key pair

...and that you didn't encounter the “Unknown Error = -2,147,414,007” on creating certificate with Certificate Assistant.


For MacOS Big Sur, I can confirm that following honey_badger's comment on the question works. I'm also pretty sure the guide covers for other macOS versions, prior to and after Mojave. Here's his comment:

Performing all the steps in section 1 of GDB Permissions Darwin resolved the issue for me on macOS Catalina (Version 10.15.4) for GDB 9.1.

  • security dump-trust-settings -d outputs "SecTrustSettingsCopyCertificates: No Trust Settings were found"
    – minseong
    Commented Mar 26, 2021 at 23:53

This is what I do:

Uncheck the Let me override defaults checkbox

and then it works fine.

I'm using High Sierra 10.13.6 (17G7024).


Before you create a certificate, you should unlock the lock on System. In this case, you won't get that error.

  • this answer does not work at all. I just confirmed a minute ago on High Sierra. You still get the same error.
    – xdavidliu
    Commented Mar 12, 2018 at 23:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .