Find a Certificate in Your Keychain by Name
Verify a named certificate is installed, see its summary, or export it to PEM — all from the terminal.
Run security find-certificate -c "Apple Root CA" ~/Library/Keychains/login.keychain-db to print the matching certificate's attributes; add -p to output the PEM text.
01Command
Command
$ security find-certificate -c "Apple Root CA" ~/Library/Keychains/login.keychain-db02What it does
find-certificate searches the given keychain (omit the path to use the default search list) for certificates whose common name matches -c. It prints keychain, class and attributes, and with -p writes the PEM body — which pipes neatly into openssl x509 -noout -subject -enddate to read expiry. Use -a to dump every matching certificate at once.
03Risk
!Warning: The output includes the public certificate only, never its private key; matching is a substring match, so a short -c string can return several certs.
04Undo
Undo
$ security find-certificate -c "Apple Root CA" -p > cert.pem05Sources
- security - Administer Keychains, Keys, CertificatesEvidence: Documents the find-certificate subcommand with -c to match a certificate by name and -p to output it in PEM format.
- security(1) man pageEvidence: The security man page describes find-certificate: find a certificate item, with -c name to search by common name and -p to export PEM data.
Last verified: 2026-09-19 · Category: Security & Privacy