How to export digital certificates on Mac

Mac utilizes Keychain Access for managing installed digital certificates. In addition, Keychain Access manages digital certificates and the following information.

• Accounts (ID and Password)
• Secret Memos
• Degital certificates
• Public keys
• Private keys

This article describes how to export a digital certificate.

About export from the Xcode

Use Xcode to export certificates presented by the Apple Developer Program for use in iOS app development and other applications in bulk. For more information, please see the following article.

See Also

Backup certificates and keys for Xcode Certificates and keys generated by the Apple Developer Program are saved on your machine. This is because they are needed for development. Therefore, I back …

This article describes how to specify individual certificates for export instead of batch export.

How to export keys with private keys

To export the private and the public keys, proceed as follows.

STEP

Launch “Keychain Access” in the “Utilities” folder in the “Applications” folder.

STEP

Select “login” from the “Default Keychains” on the left side.

Select “System” or “System Roots” for certificates initially installed on the system.

STEP

Select “Certificates” from the refinement.

STEP

Select the certificate to be exported.

STEP

Select “Export Items…” from the “File” menu.

STEP

Select the export location and enter the name.

STEP

Select the “Personal Information Exchange (.p12)” from the “File Format”.

STEP

When the password input dialog appears, enter the password and click the “OK” button.

The exported file will be encrypted with the password you entered.

STEP

When the authentication dialog appears, enter the administrator password and click the “Allow” button.

STEP

The certificate is exported to the specified location.

Verify if the key is included

Verify that the exported certificate contains the key. Since we have exported a certificate with a private key, we need to confirm that the exported certificate includes the private key. The certificate information is checked using openssl.

Run the following command in the Terminal.

% openssl pkcs12 -in certificate -noout -info

For example, when the certificate file is Certificates.p12, do as follows.

% openssl pkcs12 -in Certificates.p12 -noout -info
Enter Import Password:
MAC Iteration 1
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

You will find that the following two pieces of information are contained in the certificate.

• Certificate bag (Certificate)
• Shrounded Keybag (Key)

We have confirmed that both the certificate and the key are output.

How to export an X.509 certificate

Keychain Access can also export X.509 certificates. To export an X.509 certificate, select “Certificate (.cer)” from “File Format” in the Export dialog.

Check the contents of the exported X.509 certificate

Check that the exported X.509 certificate contains the selected certificate and public key. Use `openssl` to check.

% openssl x509 -inform der -noout -subject -in Certificates.cer

The output is then as follows.

subject= /UID=XXXXXXXXXX/CN=Apple Development: Akira Hayashi (0123456789)/OU=0123456789/O=Akira Hayashi/C=US

The name displayed in the keychain access matches the name written in the CN, so the selected certificate is exported. Also, when the following is executed, the public key in the certificate is output, and it can be confirmed that the public key is in the certificate.

% openssl x509 -inform der -noout -pubkey -in Certificates.cer
-----BEGIN PUBLIC KEY-----
(omit)
-----END PUBLIC KEY-----