How to Use the security Command in macOS Terminal to Inspect, Export, and Manage Keychain Certificates

On Apple macOS, digital certificates, private keys, code-signing identities, and public trust anchors are managed by the operating system’s unified Keychain Services subsystem. While Keychain Access provides an intuitive graphical interface for everyday credential management, system administrators, DevOps engineers, and security researchers frequently need to automate certificate deployments, audit SSL/TLS root authorities, and verify code signatures across enterprise Mac fleets without manual GUI interaction.

macOS includes the powerful native security command-line tool (located at /usr/bin/security) to interact directly with Keychain Services. This guide explains how to query certificates, inspect cryptographic metadata, export X.509 public certificates to PEM files, and configure system trust settings directly from Terminal.

Querying and Enumerating Certificates

1. Searching for Certificates by Common Name

To search all active keychains for a certificate matching a specific hostname or authority:

security find-certificate -c "Apple Worldwide Developer Relations" -a

The -c flag matches common names, while -a matches all instances rather than stopping at the first match.

2. Dumping Complete PEM-Encoded Certificates

To extract the raw base64-encoded X.509 PEM certificate payload directly to standard output or a file:

# Dump certificate to terminal
security find-certificate -c "Corporate Root CA" -p

# Export to a local .crt file
security find-certificate -c "Corporate Root CA" -p > /tmp/corporate_root.crt

The -p flag outputs the clean PEM envelope (-----BEGIN CERTIFICATE-----), making it immediately suitable for integration into OpenSSL, curl, or Docker trust stores.

Inspecting and Verifying Certificate Details

Pipe the exported PEM certificate directly into OpenSSL to inspect its cryptographic validity dates, serial number, and Subject Alternative Names (SANs):

security find-certificate -c "MyServerCert" -p | openssl x509 -noout -text | grep -A 2 "Validity"

Managing Custom Root CA Trust Policies

In enterprise internal networks or local development environments, developers frequently deploy self-signed certificates or internal root certification authorities. To install and trust a custom Root CA certificate system-wide:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/custom_root_ca.crt

• -d: Adds the certificate to the admin trust domain.
• -r trustRoot: Configures the certificate policy explicitly as a trusted root CA.
• -k /Library/Keychains/System.keychain: Installs the certificate into the global system keychain accessible by all local users and daemon daemons.

Common security CLI Commands Table

Command	Function	Privilege Required
security list-keychains	Displays current keychain search list	Standard user
security find-certificate -p	Exports certificate as PEM string	Standard user
security find-identity -p codesigning	Lists valid code-signing identities	Standard user
security add-trusted-cert	Installs and trusts root certificate	Administrator (sudo)
security remove-trusted-cert	Revokes custom trust settings	Administrator (sudo)