we want to use certificates on the iPhone to authenticate for MS Exchange Sync. We are not sure how the security concept is implemented to protect this certificates.

e.g. is it possible to get &quot;full&quot; Keychain access on the iPhone if no ScreenLock is enabled?
(or with an Jailbroken iPhone).

Does anybody has some links about this?


iOS Keychain Security

I am describing a problem for which it took me quite some time to learn the answer.

The &quot;[GenericKeychain][1]&quot; example is a good start at providing a wrapper for sharing keychain data between applications when using the accessGroup in the init.

However, implementing this in my app yielded an obscure error code (which took forever to locate) -25243, which means: No access control.

I ran Apple&#39;s example app (GenericKeychain) on my iPad only to get the same error. Huh?

Does Apple&#39;s documentation fail to deliver on what is necessary to accomplish this?


  [1]: http://developer.apple.com/library/ios/#samplecode/GenericKeychain/Introduction/Intro.html &quot;GenericKeychain&quot;

How to share keychain data between iOS applications

I have a login-screen in my iOS app.
The username and password will be saved in the `NSUserDefaults` and be loaded into the login-screen again when you enter the app again (of course, `NSUserDefaults` are permanent).

Now, the user have the possibility to disable the username/password saving feature.

So the `NSUserDefaults` will be cleared then.

But In my app I need this username/password for database queries for the user.
So: Where to store the data except `NSUserDefaults`? 
(This place can / should be deleted when the user quit the app or logout).

iOS: How to store username/password within an app?

I am using &lt;a href=&quot;http://log.scifihifi.com/post/55837387/simple-iphone-keychain-code&quot;&gt;idandersen&#39;s scifihifi-iphone&lt;/a&gt; code for keychain and save password using

    [SFHFKeychainUtils storeUsername:@&quot;User&quot; andPassword:@&quot;123&quot;
                  forServiceName:@&quot;TestService&quot; updateExisting:YES error:&amp;error];

When I delete the application from the device, the password remains in the keychain.

I want to remove the password from the keychain when the user deletes the application from the device. How can I do this?


Delete keychain items when an app is uninstalled

I had a Macintosh I used to develop iPhone apps with using Xcode 4.
I now have a new Macintosh with a new install of... everything.

When opening Xcode projects built on the old Mac, I cannot run the app on the iPhone that was configured as a development iPhone.  
Xcode 4 organizer tells me &quot;Valid signing identity not found&quot; on my provisioning profiles.

I guess this is something to do with the .certSigningRequest file I had generated before on the old Mac (I have a backup of that file), but what do I have to do with it on the new Mac?

Another strange thing, I don&#39;t see my 5 existing provisioning profiles (defined on Apple provisioning portal) in the organizer, even after a refresh and after having entered my provisioning portal login and password :

[![organizer devices screenshot][1]][1]


  [1]: http://i.stack.imgur.com/iz9AM.png

Xcode 4 - &quot;Valid signing identity not found&quot; error on provisioning profiles on a new Macintosh install

I have the following problem which I could not find a solution for anywhere. Basically, we have a company developer account (not enterprise) and so in order to submit our app, I requested from our team lead to send me the distribution certificate and create and send me a distribution provisioning profile. 

With the developer profile, everything works good, but when I installed the cert and the provisioning profile, I did not see the distribution profile on Xcode, and nor do I have a private key under the dist cert in the keychain.

Does anyone know how to solve this? I read in diff places that I will need to revoke the certificate and create a new one, but I can&#39;t really do that since we have a bunch of apps in the company and I can&#39;t revoke it for everyone.

missing private key in the distribution certificate on keychain

Using Xcode 9.1, after building an iOS app, I want to archive it and upload it to the appStore for beta-testing.
But I get the following issue after clicking the button `Upload to the App Store...` and choosing `Automatically manage signing`:

&gt; &quot;My Name&quot; has one iOS Distribution certificate but its private key is
&gt; not installed. Contact the creator of this certificate to get a copy of the private key.

I do not know why this &quot;private key is not installed&quot;, but the Distribution certificate may have been created on a different computer or something. In any case:

What is the simplest way to retrieve the missing private key and install it? In order to make things work.


Distribution certificate / private key not installed

How do I obtain a Certificate Signing Request? All I&#39;m trying to do is get my app running on my ipod touch. This was easy as I could just go to the IOS development portal and just download one, no muss no fuss. But now they want me to create a CSR to create a provisioning profile and I don&#39;t know how. I&#39;ve been derping around in Keychain Access and the online documents for the better part of two hours and I&#39;m still completely lost. 

I&#39;m not even sure why I need one now when I didn&#39;t before. I had a provisioning profile before I recently switched from Snow Leopard to Mountain Lion, but now it won&#39;t take it. Yes, I&#39;m still on the same computer.

How to obtain Certificate Signing Request

My question concerns keychains in iOS (iPhone, iPad, ...). I think (but am not sure) that the implementation of keychains under Mac OS X raises the same question with the same answer.

---

iOS provides five types (classes) of keychain items. You must chose one of those five values for the key `kSecClass` to determine the type:

    kSecClassGenericPassword  used to store a generic password
    kSecClassInternetPassword used to store an internet password
    kSecClassCertificate      used to store a certificate
    kSecClassKey              used to store a kryptographic key
    kSecClassIdentity         used to store an identity (certificate + private key)

After long time of reading apples documentation, blogs and forum-entries, I found out that a keychain item of type `kSecClassGenericPassword` gets its uniqueness from the attributes `kSecAttrAccessGroup`, `kSecAttrAccount` and `kSecAttrService`.

If those three attributes in request 1 are the same as in request 2, then you receive the same generic password keychain item, regardless of any other attributes. If one (or two or all) of this attributes changes its value, then you get different items.

But `kSecAttrService` is only available for items of type `kSecClassGenericPassword`, so it can&#39;t be part of the &quot;unique key&quot; of an item of any other type, and there seems to be no documentation that points out clearly which attributes uniquely determine a keychain item.

The sample code in the class &quot;KeychainItemWrapper&quot; of &quot;GenericKeychain&quot; uses the attribute `kSecAttrGeneric` to make an item unique, but this is a bug. The two entries in this example only are stored as two distinct entries, because their `kSecAttrAccessGroup` is different (one has the access group set, the other lets it free). If you try to add a 2nd password without an access group, using Apple&#39;s `KeychainItemWrapper`, you will fail.

**So, please, answer my questions:**  

 - Is it true, that the combination of `kSecAttrAccessGroup`, `kSecAttrAccount` and `kSecAttrService` is the &quot;unique key&quot; of a keychain item whose kSecClass is `kSecClassGenericPassword`?  
 - Which attributes makes a keychain item unique if its `kSecClass` is not `kSecClassGenericPassword`?

What makes a keychain item unique (in iOS)?

Sometimes when I run an application on device from Xcode I would try to access the keychain but fail due to error -34018. This doesn&#39;t match any of the documented keychain error codes and can&#39;t be consistently reproduced. (happens maybe 30% of the time, and it&#39;s not clear to me why it happens). What makes debugging this problem very difficult is the total lack of documentation. Any idea what causes this and how to fix it? I&#39;m using Xcode 5 and running iOS 7.0.4 on device.

There is an open issue about this here: https://github.com/soffes/sskeychain/issues/52

**EDIT: Adding keychain access code per request**

I&#39;m using the `SSKeychain` library for interfacing with keychain. Here&#39;s the snippet.

    #define SERVICE @&quot;default&quot;
    
    @implementation SSKeychain (EXT)
    
    + (void)setValue:(NSString *)value forKey:(NSString *)key {
        NSError *error = nil;
        BOOL success = NO;
        if (value) {
            success = [self setPassword:value forService:SERVICE account:key error:&amp;error];
        } else {
            success = [self deletePasswordForService:SERVICE account:key error:&amp;error];
        }
        NSAssert(success, @&quot;Unable to set keychain value %@ for key %@ error %@&quot;, value, key, error);
        if (!success) {
            LogError(@&quot;Unable to set value to keychain %@&quot;, error);
        }
        LogTrace(@&quot;Will set keychain account %@. is to nil? %d&quot;, key, value == nil);
        if (value == nil)
            LogWarn(@&quot;Setting keychain %@ to nil!!!&quot;, key);
    }
    
    + (NSString *)valueForKey:(NSString *)key {
        NSError *error = nil;
        NSString *value = [self passwordForService:SERVICE account:key error:&amp;error];
        if (error &amp;&amp; error.code != errSecItemNotFound) {
            NSAssert(!error, @&quot;Unable to retrieve keychain value for key %@ error %@&quot;, key, error);
            LogError(@&quot;Unable to retrieve keychain value for key %@ error %@&quot;, key, error);
        }
        return value;
    }
    
    + (BOOL)removeAllValues {
        LogInfo(@&quot;Completely Reseting Keychain&quot;);
        return [[self accountsForService:SERVICE] all:^BOOL(NSDictionary *accountInfo) {
            return [self deletePasswordForService:SERVICE account:accountInfo[@&quot;acct&quot;]];
        }];
    }
    
    @end



Vast majority of the time it&#39;s just fine. Sometimes I&#39;ll hit the assertion failures where I&#39;m unable to either write to or read from keychain, causing critical assertion failure. 

SecItemAdd and SecItemCopyMatching returns error code -34018 (errSecMissingEntitlement)

I am asked to type in the system admin user name and password when I compile my Xcode project. The whole message is

&gt; Mac OS X wants to make changes. Type an administrator&#39;s name and password to allow this. Mac OS X wants to use system keychain.

Does anyone have a solution for this?

Mac OS X wants to use system keychain when compiling the project

I&#39;ve generated key pairs using PuTTYgen and been logging in using Pageant, so that I have to enter my pass-phrase only once when my system boots. 

How do I achieve this in Linux? I&#39;ve heard of `keychain` but I hear that it uses a different key pair format - I don&#39;t want to change my Windows keys and it would be nice if I could seamlessly connect in the same manner in both Windows and Linux.

How to convert SSH keypairs generated using PuTTYgen (Windows) into key-pairs used by ssh-agent and Keychain (Linux)

I have a self-signed certificate at the endpoint of my API. I&#39;m trying to test some things using the simulator but am getting &quot;untrusted server certificate&quot;. 

I have tried to use safari on the simulator to download the .crt file, but that doesn&#39;t seem to work. 

Where does iPhone Simulator get its keychain from? How can I add a trusted certificate so my application will work?


**UPDATE**

I got it to work by creating a CA and then adding a CA certificate using the iPhone provisioning tool. Then I was able to have a certificate signed by that CA certificate on the API server and the NSConnection just worked. I was not able to get it to work using a self-signed certificate for some reason. I need to re-attempt this using the provisioning software.
 
My real question is how do I get this to work on the simulator? I would think that the simulator uses the keychain of the actual computer.

Adding a self-signed certificate to iphone Simulator?

I have created certificate to enable Push Services in my app, but every time I try to add certificate in my Keychain, after adding certificate it shows me following error:

**This certificate has an invalid issuer**

[![enter image description here][1]][1]


  [1]: http://i.stack.imgur.com/1DKBI.png


This certificate has an invalid issuer Apple Push Services

I am currently storing the username (email) and a salted hash of the email and password in the iOS KeyChain. I&#39;m using the ARC&#39;ified version found [here][1].

    KeychainItemWrapper *wrapper = [[KeychainItemWrapper alloc] initWithIdentifier:@&quot;MyCustomIdentifier&quot; accessGroup:nil];
    [wrapper setObject:APP_NAME forKey:(__bridge id)kSecAttrService];
    [wrapper setObject:email forKey:(__bridge id)kSecAttrAccount];
    [wrapper setObject:token forKey:(__bridge id)kSecValueData];

This all works fine when I need to pull the token out for my network calls while the app is active. It works for logging in from a clean startup, as well as all the network calls throughout. The trouble starts when the app is in the background.

Keep in mind, this only happens sporadically and I have yet to pin it down to a specific iOS version or device.

The user trips a location (region monitoring) and I want to update the server with their status. I try to pull the token out of the keychain, the same way I do for every other network call, and update the status. But for some users, the value is nil. Without it, I can&#39;t update the network stuff. Why would this work for most, but not for a small percentage?

    KeychainItemWrapper *wrapper = [[KeychainItemWrapper alloc] initWithIdentifier:@&quot;MyCustomIdentifier&quot; accessGroup:nil];
    NSString *token = [wrapper objectForKey:(__bridge id)kSecValueData];

I&#39;ve gone back to the non-ARC version of the keychainwrapper, but I still get the same results. I would appreciate any feedback on this. It is only a small part of my users, but it is an issue I would like to fix and not worry about. Thanks in advance.

Also, all of my background work is set up in a backgroundTask to prevent things from timing out. I&#39;m not having any issues with the work surrounding the keychain, but I don&#39;t let things go forward until my token is filled.

**EDIT**
I&#39;ve figured out my issue with they keychain not retrieving values from the background. I will post the answer below and accept it as I feel this question may become valuable to others later.


  [1]: https://gist.github.com/1170641

iOS KeyChain not retrieving values from background

I&#39;m trying to learn to load apps on my iPhone from Xcode.  When I do I keep getting &quot;Codesign wants to access key &quot;access&quot; in your keychain,  I put I my login password but it keeps popping up over and over.  I&#39;ve tried my computer login so many times, apple account password, and many others.

[![enter image description here][1]][1]


  [1]: https://i.stack.imgur.com/678Uf.png

Codesign wants to access key &quot;access&quot; in your keychain, I put in my login password but keeps asking me

Starting with macOS Sierra, I can&#39;t import a codesign-identity into a keychain with /usr/bin/security any more without usr/bin/codesign UI-prompting for access when using this identity. This breaks the packaging scripts of build server. There seems to be no workaround. This affects custom created keychains, but also the login.keychain.

Steps to Reproduce:
Execute the following commands in Terminal (requires a signing identity to be available to import):

    security create-keychain -p test buildagent.keychain
    security unlock-keychain -p test buildagent.keychain
    
    security list-keychains -d user -s buildagent.keychain
    security default-keychain -s buildagent.keychain
    
    security import identity.p12 -k buildagent.keychain -P password -T /usr/bin/codesign
    
    codesign -vfs &#39;$IDENTITY&#39; &#39;${PRODUCT}&#39; --keychain &#39;buildagent.keychain&#39;

Result: macOS shows a UI-prompt asking for permission to access the previously imported private key.

I have tried many workarounds, but nothing seems to work:

 - Using the new .keychain-db extension when specifying the keychain-name 
 - Using the login.keychain instead of the custom one
 - Importing the p12 with -A (&#39;Allow any application to access the
   imported key&#39;) 
 - Importing the Cert und Key separately (being extracted
   from the p12 before with openssl pkcs12)

Importing the identity definitely works, I can see the cert and key when displaying the contents of the keychain in the Keychain Access application. The access control setting for the private key is also correctly configured (with the desired codesign exception rule).

How can I avoid the UI prompt from Sierra?

security / codesign in Sierra: Keychain ignores access control settings and UI-prompts for permission

Is there an equivalent to iOS&#39;s Keychain on Android?

My understanding of the **Preferences API** is that it is not encrypted. For my application it doesn&#39;t matter whether these credentials are persisted across devices (i.e. a different use-case to https://stackoverflow.com/questions/2411281/iphone-like-keychain-in-android)

I also looked at the **KeyStore API** but it seems to leave the actual storage of user credentials up to the application developer.

Is there an equivalent to iOS&#39;s Keychain for user credentials on Android?

Which is the place I should be storing tokens for when the user logins in to a service? I&#39;m not saving passwords (obviously where I&#39;d use the Keychain) but just the token. A lot of places say just use NSUserDefaults but some people on StackOverflow seem really keen on the Keychain.

Is NSUserDefaults fine?

Storing authentication tokens on iOS - NSUserDefaults vs Keychain?

Well, I&#39;ve got my Developer Certificate linked with it&#39;s private key. Works Fine.

I&#39;ve downloaded my iOS Profile of distributor, but it says Valid signing identity not found.

So I checked my certificates, and exactly, my developer certificate it&#39;s linked with its private key but not my distribution certificate. How can I link/add my private keys to this certificate!? 

Will this solve the problem &quot;Valid Signing identity not found&quot;?



How can I add private key to the distribution certificate?

Keychain shows all the certificates as Invalid in my keychain suddenly, as it working before 2 days and i also check in Developer portal and it shows valid there. It marks each and every certificate in Keychain as **&quot;This certificate has invalid issuer&quot;** . As message suggesting that it must be problem from issuer side and and our issuer is Apple. So how to fix it ?

This certificate has an invalid issuer

Here i posting image of keychain. I need quick help.

[![enter image description here][1]][1]


  [1]: http://i.stack.imgur.com/2QglP.png

This certificate has an invalid issuer : Keychain marks all certificates as &quot;Invalid Issuer&quot;

I&#39;ve consulted many sources out there and still can&#39;t figure this out.

http://code.google.com/p/apns-php/wiki/CertificateCreation

Basically after I download the Development Push SSL Certificate from the iOS Provisioning Portal &gt; App IDS (with Enable for Apple Push Notification service selected) and I double click the certificate (filename aps_development.cer) to open it, the Keychain opens. I then select &quot;login&quot; and &quot;Certificates&quot; on the left panels.  On the right panel I see &quot;Apple Development IOS Push Services:...&quot; and all instructions I&#39;ve consulted so far have told me to &quot;expand&quot; this option by clicking the arrow next to the name to reveal the private key, but there is no expand option for this certificate. Can anyone help me find this private key? Did I download the wrong certificate?

Thanks

Can&#39;t find private key for Apple Development Push Services

How to simply store a String in Keychain and load when needed.
There are several SO solution which mostly refers to Git repo. But I need the smallest and the simplest solution on latest Swift. Certainly, I don&#39;t want to add git framework for simply storing a password in my project.

There are similar solution https://stackoverflow.com/questions/30719638 , which did not work for me. Tired with compiler errors.

Save and Load from KeyChain | Swift

I&#39;m trying to setup an automated build server for an iPhone application. I&#39;d like to be able to have nightly adhoc beta builds so that testers can follow the development.

I&#39;ve setted up xcode successfully xcode to perform adhoc builds and I can also launch the build from the command line:

&gt; xcodebuild -configuration AdHoc -sdk iphoneos2.2 clean build

The problem I&#39;m having is that the following line doesn&#39;t work from a forked terminal (using nohup or screen) and failed with the following

&gt; CodeSign error: Code Signing Identity &#39;iPhone Distribution: XXXXX&#39; does not match any code-signing certificate in your keychain.  Once added to the keychain, touch a file or clean the project to continue.


I&#39;ve checked my environment variables in my shell and in nohup or screen and didn&#39;t found a clue.
I guess my problem is that the forked terminal can&#39;t access to the keychain but I have no clue on how to allow it.

Thanks for your help

All Keychain Solutions on Gang of Coders

Total of 24 Keychain Solutions