24

I created a key pair + signed certificate for iOS/OSX development. Somewhere along the way, I lost the public key that goes with my private key. Maybe it's because Keychain Access doesn't group the private and public keys together, like it does with certificates and private keys (that is so irritating! why does it (not) do that!)

In Keychain Access, I can still right-click the private key -> "Request a certificate"; but without the public key available I get the error "The specified item could not be found in the keychain". I am pretty sure that public keys are recoverable, but how? Obviously, Keychain Access isn't smart enough to do it automatically.

I eventually figured this out and will mark my answer correct after a few days, unless someone adds something new to the answer.

Tony
  • 36,591
  • 10
  • 48
  • 83
Paul Du Bois
  • 2,097
  • 1
  • 20
  • 31

1 Answers1

62

I remembered vaguely being able to do this with openssl on .pem files, so that's the direction I headed.

  • In Keychain Access, export the private key as eg private.p12. Apply a password, or not.
  • Convert it to .pem: openssl pkcs12 -in private.p12 -out private.pem. Enter password from previous step. You're forced to apply a password to the .pem.
  • Extract the public portion: openssl rsa -in private.pem -pubout > public.pem. Enter password from previous step.
  • Import into Keychain Access: security import public.pem -k login.keychain. If you don't specify a keychain, the import appears to complete but I couldn't find where the item was put.
  • In Keychain Access, look in the login keychain for "Imported Public Key". Rename it and move to the desired location.
  • Clean up after yourself, especially those .p12 and .pem private keys with no or poor passwords.
Paul Du Bois
  • 2,097
  • 1
  • 20
  • 31
  • 9
    Step 3 failed for me because private.pem contains a certificate. It works after changing step 2: openssl pkcs12 -in private.p12 -nocerts -nodes -out private.pem – jlukanta Mar 16 '14 at 06:32
  • 3
    If you want to export the private key without including the certificate, make sure you export the private key from 'All Items' category. DO NOT export the key from the 'Keys' category on Keychain. The certificate corresponding to the private key will be included even if you did not select it. – jlukanta Mar 16 '14 at 07:16
  • how do you "rename" a keychain item? – lhunath Aug 24 '14 at 02:08
  • To rename, double-click on the item to get the Attributes dialog. Edit the Name then Save Changes. – Harry Tsai Oct 30 '14 at 02:03
  • 4
    @HarryTsai I can't rename, nothing happens after I click "Save Changes". Any ideas? Or a command line to do the same? – Slav Oct 12 '16 at 19:53
  • @Slav No idea. "Save Changes" works for me after editing the name. Does it actually change from grayed-out to active when you type into the "Name" field? Maybe there's some permissions issue? – Harry Tsai Oct 21 '16 at 15:29
  • 5
    @Slav Yes, it's a permission issue.If the permission control of your key is switched to `Confirm before allowing access`, the modification will work. You can switch the value, rename your key, and switch the value again. – Sébastien MICHOY Feb 03 '18 at 17:36