How to administer keychains and certificates using 'security' (with examples)

The security command-line utility is an essential tool for managing keychains and certificates in macOS. It offers a robust suite of options for administering keychains, including creating, deleting, and listing keychains; adding certificates; and configuring security settings for applications and services.

Use Case 1: Listing All Available Keychains

Code:

security list-keychains

Motivation:
Listing all available keychains allows you to view the current configuration of your keychain environment. This is particularly useful for developers or system administrators who work with multiple keychains and want to ensure they are accessing the correct ones for specific tasks or projects. It helps in verifying that all necessary keychains are available and have been correctly integrated into the system.

Explanation:
This command does not take any additional arguments. It simply queries the system and returns a list of keychains currently accessible to the user. The command is straightforward and outputs the result directly to the terminal, making it easy to understand and manipulate the returned data as needed.

Example Output:
The output would typically list the directory paths of available keychains, like so:

    "/Users/username/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"

Use Case 2: Deleting a Specific Keychain

Code:

security delete-keychain path/to/file.keychain

Motivation:
Deleting a keychain is necessary when a keychain is no longer needed, becomes compromised, or when you are performing maintenance to clean up obsolete keychains. This ensures that there is no unnecessary buildup of data and potential conflicts, maintaining the security and efficiency of the system.

Explanation:

• delete-keychain: This is the command used to remove a specific keychain from the system.
• path/to/file.keychain: This specifies the location of the keychain file you wish to delete. It’s important to accurately specify the path to avoid accidentally deleting the wrong keychain.

Example Output:
There is typically no output if the command succeeds. However, if an error occurs, you might see an error message related to permission issues or a non-existent keychain.

Use Case 3: Creating a Keychain

Code:

security create-keychain -p password path/to/file.keychain

Motivation:
Creating a new keychain is a fundamental task when setting up a secure digital environment. This is particularly useful for users who need to isolate credentials for specific applications or environments, thereby maintaining organized and separate areas of security data that cater to particular requirements.

Explanation:

• create-keychain: This command initiates the process to create a new keychain.
• -p password: This flag is used to set the initial password for the new keychain. It is crucial for securing the contents of the keychain.
• path/to/file.keychain: Specifies the location where the new keychain will be created. It lets the user define the storage path so they can easily find and manage the keychain.

Example Output:
Successful creation does not typically produce an output. However, the completion without error indicates the keychain was created at the specified path.

Use Case 4: Setting a Certificate for a Website or Service

Code:

security set-identity-preference -s URL|hostname|service -c "common_name" path/to/file.keychain

Motivation:
Setting a certificate for a specific service or website ensures that the correct identity is presented during authentication, providing security and trust for both the user and the service. This configuration is vital for systems that require high integrity and security levels when dealing with sensitive or private data.

Explanation:

• set-identity-preference: This option is used to specify a certificate for a service.
• -s URL|hostname|service: Defines the service, URL, or hostname the certificate is associated with, ensuring correct assignment.
• -c "common_name": Specifies the common name of the certificate being set, linking the certificate to its intended subject.
• path/to/file.keychain: Indicates where the keychain file resides that holds the certificate.

Example Output:
Success in executing this command is usually silent, with no output unless there is an error due to incorrect arguments or if multiple certificates with the same common name exist.

Use Case 5: Adding a Certificate from File to a Keychain

Code:

security add-certificates -k file.keychain path/to/cert_file.pem

Motivation:
Integrating new certificates into a keychain allows a user to manage and authenticate communications securely. This is essential for maintaining trust in encrypted communications or when installing new trusted certificates for secure services or connections.

Explanation:

• add-certificates: Command used to add a new certificate to a keychain.
• -k file.keychain: Specifies the target keychain where the certificate will be added. Omitting this defaults to adding to the default keychain.
• path/to/cert_file.pem: Indicates the file path of the certificate in PEM format to be added.

Example Output:
This adds the certificate to the specified keychain, often providing no output unless there is an error related to file format, path, or permissions.

Use Case 6: Adding a CA Certificate to Per-User Trust Settings

Code:

security add-trusted-cert -k path/to/user-keychain.keychain-db path/to/ca-cert_file.pem

Motivation:
Adding a CA certificate to a user’s trust settings allows applications and processes on the user’s profile to recognize and trust the issuer of certificates signed by this CA. This is particularly crucial for users who frequently communicate with systems requiring CA certification verification.

Explanation:

• add-trusted-cert: The command used to add a CA certificate to trust settings.
• -k path/to/user-keychain.keychain-db: Specifies which user keychain to add the CA certificate to.
• path/to/ca-cert_file.pem: File path for the CA certificate being added.

Example Output:
If successful, the user’s environment will recognize the CA as trusted with no explicit output from the command.

Use Case 7: Removing a CA Certificate from Per-User Trust Settings

Code:

security remove-trusted-cert path/to/ca-cert_file.pem

Motivation:
Removing a CA certificate is necessary when the certificate is no longer valid or has been compromised. This is part of regular security hygiene, ensuring that outdated or unsafe certificates do not undermine the security framework of the system.

Explanation:

• remove-trusted-cert: This command is used to remove a specified CA certificate from the trust settings of a user.
• path/to/ca-cert_file.pem: Specifies the CA certificate’s path that should be removed from trusted settings.

Example Output:
The command will execute silently, with no output unless there’s an error in locating the certificate file or permissions to modify trust settings.

Conclusion:

The security command is a powerful administrator tool for managing macOS keychains and certificates. Its versatility caters to a wide array of tasks that maintain and enhance the security posture of a system. Whether adding, deleting, or configuring keychains and certificates, each command the tool executes plays a critical role in upholding secure, efficient digital communication.