Remove private key from Mac OS X keychain using Terminal

Question

I've imported a developer identity (certificate + private key) for iOS development to a keychain using the "security" Terminal application with the command

security import identity.p12 -k <keychain> -P <passphrase>

This imports both items included in the p12 file, certificate and private key, into the given keychain. I forgot to specify -T /usr/bin/codesign, however, which adds the codesign application to the access list of the private key. I've tried to add the codesign app to the access list to no avail:

• I've tried to re-import the identity with the added parameter but that does not seem to change the access list of the private key.
• I've also tried deleting the certificate from the keychain using security delete-certificate and re-importing. This does not change the access list of the private key.

Since I only have ssh access to the machine, using the Keychain GUI application won't work. Therefore I'm looking for a way to delete the private key from the keychain (so that I can re-import the identity afterwards). I've checked the man page of the security tool but did not find a means to delete a private key.

Is there any way you can remove a private key from a keychain using Terminal commands only (as I do only have ssh access to the machine in question)?

Answer 1

There are several keychains on your system:

sudo security list-keychains
"/Users/JonDoe/Library/Keychains/login.keychain"
"/Library/Keychains/System.keychain"

I think you imported it into the System-Keychain: First make a backup of your System Root Certificates before making any changes (or any other keychain you choose):

cd /System/Library/Keychains/
sudo cp SystemRootCertificates.keychain SystemRootCertificates.keychain.old

List all keychains / all certificates in your keychain:

ls -l /System/Library/Keychains/
sudo security dump-keychain /System/Library/Keychains/SystemRootCertificates.keychain

With the second command each certificate of the keychain is shown. Identify the certificate you want to remove. Then remove the certificate with the following command:

sudo security delete-certificate -Z <SHA-1 hash of certificate> /System/Library/Keychains/SystemRootCertificates.keychain
**alternative:**
sudo security delete-certificate -c <common name of certificate> /System/Library/Keychains/SystemRootCertificates.keychain

That's all. Now you can import your certificate again. In case of an error, you can restore your keychain with the following command:

sudo security import certificate_files_backup -k /System/Library/Keychains/SystemRootCertificates.keychain -t cert

Answer 2

You can delete certificate and key by running a command in the terminal:

sudo security delete-identity -Z "SHA-1"

or

sudo security delete-identity -c "CommonName"

At the beginning I thought it removes only the key, but in fact it removes certificate too (you just need to close the keychain completely and open it again to see the changes - if you are verifying it with GUI).

From man security:

     delete-identity [-h] [-c name] [-Z hash] [-t] [keychain...]
        Delete a certificate and its private key from a keychain.  If no keychain arguments are provided, the default search list is used.

        -c name         Specify certificate to delete by its common name
        -Z hash         Specify certificate to delete by its SHA-1 hash
        -t              Also delete user trust settings for this identity certificate

You may need to unlock the keychain first (from man security):

 unlock-keychain [-hu] [-p password] [keychain]
        Unlock keychain, or the default keychain if none is specified.