Keychain: ask for certificate from command line

command linekeychainSecurity

Is it possible to ask for certificate (.certificateRequest file) from command line?

I want to mimic behavior like Keychain -> Certificate Assistant -> Request for Certificate in Certificate Buro from command line.

Good tool /usr/bin/security does not provide requests to Certificate Buro. Maybe I wrong here.

Could anybody help with it?

Best Answer

Use the supplied "certtool" program. The "r" option allows you to generate a new certificate signing request (CSR).

Related Solutions

MacOS – Updating Keychain entry manually prevents next access from GUI tools afterwards: Always asks for permission

For macOS Sierra:

To add an object and allow access (with user prompt), use the "-T Application" option. (Several applications can be used)

security add-generic-password -a "account" -s "name" -w 'password' -c aapl -T /Applications/Utilities/Keychain\ Access.app/Contents/MacOS/Keychain\ Access

Then to allow access without user prompt you need to modify the ACL for the object:

security -v set-generic-password-partition-list -s "name" -S "apple:"

The partition-list syntax is not very well documented. You might be able to see how Tunnelblick uses the ACL from the output of "security dump-keychain".

Source: man security

Keychain management command-line utility

I haven't tried recovering data with it yet but I think the following works:

security create-filevaultmaster-keychain ~/Desktop/FileVaultMaster.keychain

security export -k ~/Desktop/FileVaultMaster.keychain -t certs -o ~/Desktop/FileVaultMasterPublic.cer

sudo fdesetup changerecovery -institutional -certificate ~/Desktop/FileVaultMasterPublic.cer

In my case FileVault was already enabled so I just added it after the fact.

Best Answer

Related Solutions

MacOS – Updating Keychain entry manually prevents next access from GUI tools afterwards: Always asks for permission

Keychain management command-line utility

Related Question