Search code examples
certificatekeychain

Retrieve a certificate's SHA1 hash from macOS Keychain Access via Terminal

This answer only provides an answer of a way to get the SHA1 code via Keychain Access UI: Retrieve a certificate's SHA1 hash from macOS Keychain Access

Is there a way to see the SHA1 hash for the certificates via the security dump-keychain command or something similar?

Solution

  • You can use the security cli to find a certificate. Providing the right query and the right parameters will output the SHA-1 hash.

    security find-certificate -Z

    You can alter the find-certificate command to perform a better selection. The -Z parameter adds the SHA-1 and SHA-256 hash to the output.

    One final remark, SHA-1 is considered insecure since 2005. I highly recommend switching to SHA-256, which conveniently is also outputted via the -Z parameter