My IKEv2 VPN client certificates are stored in Keychain. When I initiate a VPN connection, I'm immediately prompted for my Macbook administrator account password before access to the Client certificate stored in Keychain required for the connection is allowed:

Keychain Dialog for Cert Access

You'll note from reviewing the dialog, there's no option to persistently allow future access by retaining the password

Given that mobile workers use VPNs in public places with cameras everywhere, re-keying this password is not ideal. Even more so if one's business takes them to countries with authoritarian regimes.

I could allow it always in keychain, but this requires you choosing the binary that is calling the Keychain. This is where I'm stuck: What binary is responsible for initiating the VPN connection?

When I double-click the cerrt in Keychain and choose the "Access Control" tab, I'm offered the option to choose a application to persistently allow Keychain access to. This is why I need the binary that Apple uses to make VPN connections:

Dialog asking for a file to allow

  • Can you post a screenshot of the password request? Usually, it should offer you to choose between allowing access "this time" or "always". – not2savvy Jul 14 at 13:01
  • Not offered that option. I would have JUMPED at the opportunity! – F1Linux Jul 14 at 13:05
  • How was the VPN client set up? Which client is it? Which keychain are the certificates stored in? Is the VPN user different from the admin user? – not2savvy Jul 14 at 13:45
  • I use the Apple VPN client and point it to the Cert in Keychain the device uses for authenticating. Only have a single keychain. Client Certs are pkcs12 format. Hence probably the cautiousness in requiring a password. – F1Linux Jul 14 at 13:59
  • I don't quite understand your setup. The certificates are either in a PKCS12 store or in the keychain, not both. You always have different keychains. If you look at the entries, on the right it tells you which keychain the object is in: system keychain or your personal login keychain. The certificates should be in your login keychain, as usually this is the keychain that can be accessed without additional authentication once the user has logged in. – not2savvy Jul 14 at 14:05

You must log in to answer this question.

Browse other questions tagged .