On Windows, when retrieving information about certificates, they come from named certificate stores, such as "Trusted Root Certification Authorities" or "Trusted Publishers" - what is the equivalent on macOS?

My best guess is types of keychains, e.g. "login" or "System", but those are sufficiently different that I'm not sure. The names also don't seem to come with the certificates (when using SecItemCopyMatching in Swift, for example).

The context of why I need this: I've been asked to gather data about users' computers (so IT can see aggregate data), and most of the work was done for the Windows side of things before I got here. I'm trying to gather the same certificate data for macOS that is currently gathered for Windows. Most of it is easily obtained from both (e.g. the Subject, the Expiration), but the Windows code has a value called the Certificate Store that I don't readily see an analog for in macOS.


The equivalent on macOS is the Keychain name.

On Windows you have for example the "Current User Certificate Store". The corresponding on macOS would be the user's login keychain: ~/Library/Keychains/login.keychain-db. There's one for each user on the system, and stores the certificates relevant to that user only.

On Windows you have the "Local Machine Certificate Store" that holds certificates added by users to be accessed by all users on the local computer. The corresponding on macOS would be the System keychain: /Library/Keychains/System.keychain

On Windows you have the "Trusted Root Certification Authorities Certificate Store" that holds CA certificates trusted by the operating system in general. The corresponding on macOS is the System Root Certificates keychain: /System/Library/Keychains/SystemRootCertificates.keychain

You can list the certificates in each of those keychains by using the built-in security command. For example to get an overview list:

security find-certificate -a ~/Library/Keychains/login.keychain-db
security find-certificate -a /Library/Keychains/System.keychain
security find-certificate -a /System/Library/Keychains/SystemRootCertificates.keychain

or to export the actual certificates in PEM format:

security find-certificate -a -p ~/Library/Keychains/login.keychain-db
security find-certificate -a -p /Library/Keychains/System.keychain
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain

The exception to the rule above is what is known as the "Trusted Publishers Certificate Store" in Windows - this is not stored in a Keychain on macOS, but instead in a system assessment rule database. The name of that is: /var/db/SystemPolicy

You can create a list of those with the following command:

sudo spctl --list --type execute

The output is a list of assessment rules, which besides a few generic, Apple specific rules, is basically a list of the hashes of the certificates of the trusted publishers.

The actual certificate information cannot be exported from the SystemPolicy database, as they're not contained there. You can however get to that data by traversing the installed applications (for example in /Applications) and running:

codesign -d -r- -vvvv /Applications/AnApp.app

This allows you to gather information such as the publisher's name, subject organisational unit, CA name (Apple Root CA) and timestamps.

  • Thanks! I've now asked on SO how to get the keychain name through Swift, hopefully an answer will come there. – ZAD-Man Dec 31 '20 at 18:50
  • 1
    You can just run the above mentioned commands from Swift if you want, but you can also use the ordinary KeychainServices API in Swift to obtain this information. – jksoegaard Dec 31 '20 at 22:16
  • Oh, awesome! I'm a Swift newbie and didn't realize that could be done, that opens up a lot. – ZAD-Man Dec 31 '20 at 22:37

So, the best way to collect this information on macOS is to utilize an MDM. It helps for not having to reinvent the wheel for IT department type queries and requests. There is no benefit to knowing which keychain a certificate is stored so I wouldn’t focus on that narrow request and engage IT straight on to build a proper framework for all Mac management tasks they will need.

I generally use JAMF Pro to collect all certificates across the enterprise so we can manage things like this, but you could use other MDM if you want open source as opposed to commercially supported tools. There is no direct equivalent so let IT know they’re asking you something equally not present on macOS.

Back to practical certificate tasks, here’s what a detected certificate looks like in The JAMF Pro UI and some backup that you have to manage Macs differently then windows endpoints from a vendor like Cisco.

enter image description here

  • Ok, so in that case I could probably just say N/A, or "macOS Keychain" if they really want something – ZAD-Man Dec 30 '20 at 0:19
  • 1
    So, it doesn’t matter which part of the keychain a cert is stored. The user either has a cert available to use or doesn’t. @ZAD-Man so macOS stores certs, but the mechanism is substantially different than how Microsoft implemented it. – bmike Dec 30 '20 at 1:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .