My IKEv2 VPN client certificates are stored in Keychain. When I initiate a VPN connection, I'm immediately prompted for my Macbook administrator account password before access to the Client certificate stored in Keychain required for the connection is allowed:
You'll note from reviewing the dialog, there's no option to persistently allow future access by retaining the password
Given that mobile workers use VPNs in public places with cameras everywhere, re-keying this password is not ideal. Even more so if one's business takes them to countries with authoritarian regimes.
I could allow it always in keychain, but this requires you choosing the binary that is calling the Keychain. This is where I'm stuck: What binary is responsible for initiating the VPN connection?
When I double-click the cerrt in Keychain and choose the "Access Control" tab, I'm offered the option to choose a application to persistently allow Keychain access to. This is why I need the binary that Apple uses to make VPN connections: