I'd like to export specific keys from my keychain using the command line. As far as I see, this would involve the security tool. When I have multiple keys with the same name, how can I export a specific one of these keys? Can I specify a key id or hash value? For instance one can specify the type like -t privKeys, but this would not limit the result to a specific key.

Or going at this from a different angle: Is there a possibility in Keychain Access to view the key id / fingerprint of a key? For instance I have quite a few keys, which all are named the same and "Get Info" shows no details which would let me really distinguish one from another. I have a feeling I'm missing something here.

1 Answer 1


No, it is not possible to search by key identifier or hash.

Unfortunately the underlying Keychain API is limited in the attributes that can be searched for.

If you are fortunate, paired certificate and keys exist within a Keychain. These pairings are called Identities within the API. Within Keychain Access they appear as a certificate with a disclosure triangle to one side; expanding the item reveals the paired key.

Otherwise applications working with Keychain have to enumerate the available certificates and keys to find specific pairs.

I wrote Keysafe, so am painfully familiar with the underlying .keychain file format.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .