Import a P12 Certificate into the Keychain with security

The built-in security tool imports .p12/.pfx certificates plus private keys into a keychain, with an -T allowlist for signing apps.

macOSKeychaincertificatesecurityMedium risk

Run `security import cert.p12 -k ~/Library/Keychains/login.keychain-db -P "password" -T /usr/bin/codesign` to import a certificate.

01Command

Command

$ security import client.p12 -k ~/Library/Keychains/login.keychain-db -P "p12password" -T /usr/bin/codesign

02What it does

This is the standard non-interactive way to install client certificates for codesigning or mTLS on CI machines and fresh Macs. -P supplies the P12 export password, and -T lists which binaries may use the private key without a per-use prompt — codesign for signing, curl or ssh for mTLS. After importing for signing work, you typically also run `security set-key-partition-list -S apple-tool:,apple: -k <login-password> <keychain>` to allow headless access.

03Risk

RiskMedium risk

!Warning: Passing the P12 password on the command line exposes it in shell history — prefer the interactive prompt or clear history afterward.

04Undo

Undo

$ security delete-certificate -c "Common Name" ~/Library/Keychains/login.keychain-db

05Sources

security — administer keychains and keys (macOS man page)
SS64 · technical · 2026-09-17
Evidence: Documents security import in_file -k keychain -P passphrase and the -T application allowlist for using the imported key.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil

macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17