My company has most of it's internal sites behind an SSO site (weblogin.comnpany.com using pubcookie). I'm trying to automate some tasks that need to log in with SSO to access some of these sites. Recently the weblogin page requires a client cert to be in order to even present the form to enter your password. So I need to load my client cert in order to get started with this automation.

I'd like to do something like this:


In this example, the client certs are loaded like this:

ssl_options = {
  cert: OpenSSL::X509::Certificate.new(File.read('./certificate/client-2048.pem')),
  key:  OpenSSL::PKey::RSA.new(File.read('./certificate/client-2048.key'), 'mypassword')

What are the equivalent file paths ('./certificate/client-2048.pem' and './certificate/client-2048.key') on Mac OS X?

I've read this over: Where are digital certificates physically stored on a Mac OS X machine?

but I don't believe it mentions where private/public keys are actually stored.

  • Try security list-keychains. You can dump the content with the dump-keychain subcommand, too. – jvb Jun 12 '17 at 14:08
  • this just gives: $ security list-keychains "/Users/myldap/Library/Keychains/login.keychain" "/Library/Keychains/System.keychain" – Ramy Jun 12 '17 at 16:24
  • @Ramy, that is correct. On macOS, personal certs and their matching private keys are stored in the keychain files and accessible via keychain APIs. – Spiff Jun 12 '17 at 18:47
  • ok, maybe i'm still missing something: $ dump-keychain /Library/Keychains/System.keychain -bash: dump-keychain: command not found – Ramy Jun 12 '17 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.