2

Problem

If I SSH to the mac remotely from another computer, then view valid code-signing identities, I get CSSMERR_TP_CERT_REVOKED, as seen below.

# executing remotely in an ssh session

% security find-identity -p codesigning -v my.keychain
Policy: Code Signing
  Matching identities
  ...
  14) A5D306527C135180E1313619AD54C1890ABBFF81 "Apple Distribution: Company Inc. (TEAM_ID_VALUE)" (CSSMERR_TP_CERT_REVOKED)
  ...
  Valid identities only
  ...
  14) A5D306527C135180E1313619AD54C1890ABBFF81 "Apple Distribution: Company Inc. (TEAM_ID_VALUE)" (CSSMERR_TP_CERT_REVOKED)
  ...

But when I run the same command above in the Terminal app of the mac itself, I don't see CSSMERR_TP_CERT_REVOKED.

# executing from the Terminal app in the mac itself

% security find-identity -p codesigning -v my.keychain
Policy: Code Signing
  Matching identities
  ...
  14) A5D306527C135180E1313619AD54C1890ABBFF81 "Apple Distribution: Company Inc. (TEAM_ID_VALUE)"
  ...
  Valid identities only
  ...
  14) A5D306527C135180E1313619AD54C1890ABBFF81 "Apple Distribution: Company Inc. (TEAM_ID_VALUE)"
  ...

Question

Why does CSSMERR_TP_CERT_REVOKED show only when I run the security find-identity command remotely via SSH? How can I remove it if possible?

I suspect that it has more to do with SSH than the certificate actually being revoked. But I don't know where else to look for clues.

What I tried

  1. I checked the certificate from the Keychain app of the mac. It shows the certificate is valid, with a green checkmark.
  2. I checked the certificate trust settings. Even if I set it to "always trust", the CSSMERR_TP_CERT_REVOKED still shows.
  3. I tried locking and unlocking my.keychain from the SSH session, but the CSSMERR_TP_CERT_REVOKED still shows. Unlocking the login.keychain too doesn't help.
  4. I tried security set-key-partition-list ... from the SSH session, but CSSMERR_TP_CERT_REVOKED still shows.
  5. I looked into differences in environment variables using printenv between SSH and the Terminal app, but I don't think there's anything relevant.
2
  • Does the behaviour change if you ssh in locally, via ssh localhost? Commented May 24 at 5:55
  • @GrahamMiln via ssh localhost from the Terminal app in the mac, it shows CSSMERR_TP_CERT_REVOKED.
    – Christian
    Commented May 24 at 6:02

0

You must log in to answer this question.

Browse other questions tagged .