Macos – Keychain First Aid locks the keychain and can’t unlock it to perform first aid

keychainkeychain-accessmacos

After upgrade to OS X El Capitan I keep having problems with the keychain (such as needing to enter the keychain password every time an app wants to access the keychain, even though auto lock settings are off, and Keychain Access app shows it's unlocked already).

In Keychain Access app whenever I try to run Keychain First Aid on my login keychain I get this:

Verification started
Checking keychain configuration for kornel (user ID=501)
Home directory is /Users/kornel
Checked login keychain
Checked settings for ~/Library/Keychains/login.keychain
Keychain can't be unlocked automatically. Please attempt to unlock ~/Library/Keychains/login.keychain from Keychain Access.
Checked default keychain
Checked contents of ~/Library/Keychains/login.keychain
No problems found
Verification completed

The problem is that my keychain appears to be unlocked already, and starting the First Aid locks it.

How can I stop the keychain from locking itself? Or rebuild it without losing saved passwords?

Best Answer

I've found the culprit: Junos Pulse VPN software (5.1) breaks the keychain and system CA certificates in OS X 10.11.

I've deleted Junos Pulse completely, and the system is happy now.

Related Solutions

Macos – How to revoke access to the Keychain on Macosx

Does it say “So-and-so wants to use the login keychain; please enter the password”? I think that unlocks the keychain as a whole, and once it’s open any app can create entries. Access is controlled on individual entries, and only the app that created it and other authorized apps can read the password.

For example, here’s the access control for one entry in my keychain:

Screenshot of Keychain Access

In Keychain Access on OS X, Find matching public and private keys

I guess you have been able to get around your problem as this is an old thread, but I am just writing a reply for any future reference.

The basic idea is to export your private and public keys, and use openssl to view their modulus. Matching private/public keys will have the same modulus.

Here is how to see the modulus of a private key:

In Keychain Access export your private key and select "Personal Information Exchange (.p12)" file format. This will create .p12 file.
Launch a terminal and use openssl to convert your .p12 file to a .pem file:
```
openssl pkcs12 -in key.p12 -out key.pem -nodes
```
Use openssl to view the modulus of the pem private key:
```
openssl rsa -in key.pem -modulus -noout
```

Here is how to see the modulus of a public key:

In Keychain Access export your public key and select "Privacy Enhanced Mail (.pem)" file format. This will create .pem file.
This .pem file is a PKCS#1 PEM file (with a header -----BEGIN RSA PUBLIC KEY-----), while openssl can only read PKCS#8 PEM (with a header -----BEGIN PUBLIC KEY-----). So open up your exported public key in TextEdit and remove the RSA bit from the header and the footer, and save the changes.
Use openssl to view the modulus of the pem public key:
```
openssl rsa -pubin -in pubkey.pem -modulus -noout
```

Please also note that in fact, you could also delete your public keys and re-create them from the private keys (that way you could be certain of your matching pairs). To create the matching public key from a private key use the following openssl command:

openssl rsa -in key.pem -pubout -out pubkey.pem

Related Question