How to export digital certificates on Mac

Mac utilizes Keychain Access for managing installed digital certificates. In addition, Keychain Access manages digital certificates and the following information.

  • Accounts (ID and Password)
  • Secret Memos
  • Degital certificates
  • Public keys
  • Private keys

This article describes how to export a digital certificate.


About export from the Xcode

Use Xcode to export certificates presented by the Apple Developer Program for use in iOS app development and other applications in bulk. For more information, please see the following article.

This article describes how to specify individual certificates for export instead of batch export.

How to export keys with private keys

To export the private and the public keys, proceed as follows.

Keychain Access
Keychain Access
Select “login” from the “Default Keychains” on the left side.

Select “System” or “System Roots” for certificates initially installed on the system.

Select “Certificates” from the refinement.
Select the certificate to be exported.
Select the certificate
Select the certificate
Select “Export Items…” from the “File” menu.
Select the export location and enter the name.
Select the “Personal Information Exchange (.p12)” from the “File Format”.
Export dialog
Export dialog


Password input dialog
Password input dialog
When the authentication dialog appears, enter the administrator password and click the “Allow” button.
The certificate is exported to the specified location.
Exported certificate
Exported certificate

Verify if the key is included

Verify that the exported certificate contains the key. Since we have exported a certificate with a private key, we need to confirm that the exported certificate includes the private key. The certificate information is checked using openssl.

Run the following command in the Terminal.

% openssl pkcs12 -in certificate -noout -info

For example, when the certificate file is Certificates.p12, do as follows.

% openssl pkcs12 -in Certificates.p12 -noout -info
Enter Import Password:
MAC Iteration 1
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

You will find that the following two pieces of information are contained in the certificate.

  • Certificate bag (Certificate)
  • Shrounded Keybag (Key)

We have confirmed that both the certificate and the key are outp

How to export an X.509 certificate

Keychain Access can also export X.509 certificates. To export an X.509 certificate, select “Certificate (.cer)” from “File Format” in the Export dialog.

Export dialog
Export dialog
X.509 certificate
X.509 certificate

Check the contents of the exported X.509 certificate

Check that the exported X.509 certificate contains the selected certificate and public key. Use `openssl` to check.

% openssl x509 -inform der -noout -subject -in Certificates.cer

The output is then as follows.

subject= /UID=XXXXXXXXXX/CN=Apple Development: Akira Hayashi (0123456789)/OU=0123456789/O=Akira Hayashi/C=US

The name displayed in the keychain access matches the name written in the CN, so the selected certificate is exported. Also, when the following is executed, the public key in the certificate is output, and it can be confirmed that the public key is in the certificate.

% openssl x509 -inform der -noout -pubkey -in Certificates.cer
-----END PUBLIC KEY-----

Authored Books

Let's share this post !

Author of this article

Akira Hayashi (林 晃)のアバター Akira Hayashi (林 晃) Representative(代表), Software Engineer(ソフトウェアエンジニア)

アールケー開発代表。Appleプラットフォーム向けの開発を専門としているソフトウェアエンジニア。ソフトウェアの受託開発、技術書執筆、技術指導・セミナー講師。note, Medium, LinkedIn
Representative of RK Kaihatsu. Software Engineer Specializing in Development for the Apple Platform. Specializing in contract software development, technical writing, and serving as a tech workshop lecturer. note, Medium, LinkedIn