Saturday, July 5, 2025

The way to restrict `set-key-partition-list` to 1 certificates

TLDR: How can I discover make safety set-key-partition-list run in opposition to a single entry, relatively than all the things within the keystore?


I used to be going through points with a cipher mismatch with an dotnet/aspnet app and a self signed cert:
The way to restrict `set-key-partition-list` to 1 certificates

Finally I discovered this github problem, which led me to

log stream --process <PID_OF_SECURITYD> 

Giving:

 securityd: [com.apple.securityd:integrity] failure extending partition  securityd: [com.apple.securityd:security_exception] MacOS error: 32  securityd: [com.apple.securityd:clientid] code requirement examine failed (-67050), shopper isn't Apple-signed  securityd: [com.apple.securityd:integrity] ACL partition mismatch: shopper teamid:UBF8T346G9 ACL ("cdhash:71c6a2e36e9b3aa01232049c467ebbad51311b9") 

Looking from there gave me this SO query(!), which steered

sudo safety set-key-partition-list -D localhost -S unsigned:,teamid:UBF8T346G9 $(safety login-keychain) 

And voila, this labored – I can now use this certificates to run the app regionally.

However, that command ran in opposition to ~2489 entries, relatively than the 1 that I anticipated.

So, how can I discover make safety set-key-partition-list run in opposition to a
single entry, relatively than all the things within the keystore?

Plainly safety find-key has utterly completely different args that do not appear to match – I both get no outcomes, or ~2489 outcomes.

I’ve even bought to the purpose of spelunking by means of the supply code to try to determine this out, however I did not get very far.

Related Articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest Articles