Export Certificates as PEM with security find-certificate -p

Pull public certificates out of a macOS keychain into PEM format for tools that need a file.

macOSKeychaincertificatesecurityMedium risk

Run `security find-certificate -c "<name>" -p > cert.pem` to export one cert, or `-a -p` to dump every cert in a keychain.

01Command

Command

$ security find-certificate -a -p /Library/Keychains/System.keychain > ca-certs.pem
# Export one named cert from the login keychain:
security find-certificate -c "My Root CA" -p > root-ca.pem

02What it does

`security find-certificate -p` writes the certificate in PEM (base64) form to stdout, ready to redirect into a .pem file for curl, nginx, or a Java trust store. The `-c` flag selects by certificate name, while `-a` matches all — the pair `-a -p` against the System keychain produces a complete CA bundle from the Mac's trust anchors. Note that `-p` exports public certificates only; private keys need `security export` with additional privileges.

03Risk

RiskMedium risk

!Warning: Redirecting stdout matters: without `> file.pem`, the base64 blob floods your terminal.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

security — macOS Command Reference
SS64 · technical · 2026-09-17
Evidence: Documents find-certificate with -c (name), -p (PEM) and -a (all).

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil

macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17