Macos keychain can't export as p12; also says cert is "not trusted"

[bozdoz]

I went through all of these steps: https://github.com/alexandercerutti/passkit-generator/wiki/Generating-Certificates

But at step 6:

Once downloaded the certificate in .cer format, open (import) the downloaded certificate in macOS Keychain Access. Filter for "Certificates" and identify your imported certificate. Right-click on it and select Export "<certname>". Choose a password (and write it down) and you will get a PKCS#12 file (.p12).

I'm never asked for a password, and the p12 file is greyed out; see screenshot. What am I doing wrong?

[alexandercerutti]

Hi @bozdoz, thank you for using passkit-generator!

Honestly? I don't know. I don't know the reason why a certificate like WWDR or yours does not show the possibility to export as P12.

Can you try to follow this guide at let me know if you succeeded? https://fluffy.es/keychain-cant-export-to-p12/

Let me know!

[bozdoz]

Doesn't seem to work; my ui doesn't even look like that. guess that guide is from 2019. I don't see any dropdown arrows for example.

I might just try the terminal version, instead of using keychain. Thanks!

[alexandercerutti]

Okay! I'd be very curious to compare my .cer with yours to understand if there's any specific reason. Are you willing to share it with me in a private way?

[bozdoz]

Absolutely!

[alexandercerutti]

If you have Telegram, you can write me there (you can check it on my profile). Otherwise via email (I will tell you if needed)

[alexandercerutti]

Thank you for your certificate!
By doing a little bit of research, I found out that Keychain Access actually creates a couple of public and private keys when you create a CSR (Certificate Signing Request) with a name you choose:

So I guess that, when it generates a P12, it is somehow able (I actually don't know how, but keep reading) to link the certificate and the public key and pack them both into a P12.

I think this article in the Apple Developer Forum might explain what happens under the hood: https://developer.apple.com/forums/thread/681696

In your case, I guess your Keychain access is not able to link your certificate with your public key. Just like you didn't create by yourself the certificate or perhaps changed it (how?).

I hope this was hopeful.