"Unknown Error = -2,147,414,007" on creating certificate with Certificate Assistant

Question

I am getting "Unknown Error = -2,147,414,007" on creating a certificate through the Keychain app.

Steps to Recreate:

1. Open the Keychain Access application. Select Certificate Assistant > Create a Certificate in the application menu (Keychain Access). Only Modified Parameters are listed. The remaining options are kept with default values.

   Name of Certificate = gdbcert
   Identity Type = Self Signed Root
   Certificate Type = Code Signing

2. Check the Let me override defaults checkbox, and click Continue.

3. On the next page, leave Security Number to be 1, and set Validity Period to 3650.

4. Then click Continue once again, and keep doing so to skip the next six screens until you see the one entitled Specify a Location For The Certificate.

5. For the only property, Keychain, choose System from the drop-down list. Lastly, click Create, type in your password, if prompted, and click Done.

Update: I'm able to create certificates to the Login Keychain. The issue is only when I try to create certificates for the System Keychain.

Answer 1

Was able to get this to work. The purpose for creating a certificate was to codesign gdb on Mac. Here are the steps for the same:-

• Create a certificate with all the parameters mentioned above.
• Instead of saving the Keychain under location System, save it under Login.
• Then, unlock the System Keychain by clicking on the lock icon on the top left corner and drag the certificate from Login to System.
• Right Click the Certificate, click on Get Info and and under Trust, set to Always Trust.
• Restart taskgated in terminal: killall taskgated
• Enable root account:
  Open System Preferences.
  Go to User & Groups > Unlock.
  Login Options > "Join" (next to Network Account Server).
  Click "Open Directory Utility".
  Go up to Edit > Enable Root User.
  
• Run codesign -fs gdbc /usr/local/bin/gdb in the terminal.
• Disable Root Account again and you should be good to go.

Credits:

• Keychain Access error when creating new system certificate
• https://gist.github.com/hlissner/898b7dfc0a3b63824a70e15cd0180154

Answer 2

My workaround was a little bit different. I checked the option "Let me specify key pair information" and went with what was selected by default. Key size was 2048 bits and Algorithm was RSA. That seemed to let me get around the "Unknown Error = -2,147,414,007".

Answer 3

I received this error on one of my users computers after he updated to Mojave against my suggestions.

The end result for the certificate issue was keeping my user from connecting to our employee wifi.

I followed Danis's instructions from 12/15/17 but the terminal commands didn't work and my company uses a certificate from a CA server, so the details were a little different. I did enable the root user though.

Finally I deleted our employee wifi out of the network settings, manually rejoined the Employee wifi and changed the security settings back to EAP-TLS, choosing the correct certificate, and it connected.

I wish I had recorded my steps better for this but I'm assuming Apple updated some of their network security and it was the wifi connection settings that actually did the trick.

Answer 4

Disclaimer: Keychain Access is rarely behaving as expected.

Admittedly, the following answer is a workaround as it creates both a CSR and a new set of associated keys.

1. Launch Keychain Access, unlock it, select Login (but do not select anything else)

   

2. In the Keychain Access menu
   Certificate Assistant ▶︎ Request a Certificate From a Certificate Authority...

   

3. Pick the email address to be associated with both the CSR and the key pair.

   • The key pair will be named in Keychain Access according to the Common Name
   • Tick Let me specify the key pair information (which you will do in a subsequent dialog)
     

4. Save the Certificate Signing request

   

5. Specify key size & algorithm RSA 2048 bits

   

6. Check your new set of keys in Keychain Access Notice that the Login section now contains a new pair...

   

...and that you didn't encounter the “Unknown Error = -2,147,414,007” on creating certificate with Certificate Assistant.

Answer 5

For MacOS Big Sur, I can confirm that following honey_badger's comment on the question works. I'm also pretty sure the guide covers for other macOS versions, prior to and after Mojave. Here's his comment:

Performing all the steps in section 1 of GDB Permissions Darwin resolved the issue for me on macOS Catalina (Version 10.15.4) for GDB 9.1.

Answer 6

This is what I do:

Uncheck the Let me override defaults checkbox

and then it works fine.

I'm using High Sierra 10.13.6 (17G7024).

Answer 7

Before you create a certificate, you should unlock the lock on System. In this case, you won't get that error.