# Certificates Manage digital certificates. ## Discussion A digital certificate is a collection of data used to securely distribute the public half of a public/private key pair. Figure 1 shows the parts of a typical X.509 certificate that make this possible. Along with structural information, the certificate contains name and contact information for both its issuer and its owner (or subject), plus the owner’s public key. A date range indicates when the certificate is valid. Certificate extensions provide additional information and conditions, like acceptable uses for the public key. When assembling the certificate, to vouch for its integrity, the issuer digitally signs it using the issuer’s own identity (private key and certificate).  To evaluate a certificate, you first verify its signature using the specified algorithm and the issuer’s public key, which you obtain from the issuer’s publicly available certificate. A valid signature confirms that the certificate under evaluation, known as the leaf certificate, is unaltered. But in order to trust this result, you must also trust the issuer’s certificate. You use a similar procedure to test this certificate, and the one that guarantees that certificate, and the next, and so on in a chain back to a trusted root authority whose certificate, known as the anchor, which you trust implicitly. The public key included in the leaf certificate is then considered trustworthy. You can be assured that it has come unaltered from the certificate’s owner who controls the corresponding private key. This allows you to securely use the public key to engage in asymmetric cryptography with the certificate’s owner. For more details about how certificates work, read [Digital Certificates](https://developer.apple.com/library/archive/documentation/Security/Conceptual/cryptoservices/CryptographyConcepts/CryptographyConcepts.html#//apple_ref/doc/uid/TP40011172-CH8-CHDBIGCE) in [Cryptographic Services Guide](https://developer.apple.com/library/archive/documentation/Security/Conceptual/cryptoservices/Introduction/Introduction.html#//apple_ref/doc/uid/TP40011172). ## Topics ### Essentials [Getting a Certificate](/documentation/Security/getting-a-certificate) Obtain a certificate from an identity, from DER-encoded data, or from the keychain. [Storing a Certificate in the Keychain](/documentation/Security/storing-a-certificate-in-the-keychain) Store a certificate in the keychain for safekeeping. [`SecCertificate`](/documentation/Security/SecCertificate) An abstract Core Foundation-type object representing an X.509 certificate. [`SecCertificateGetTypeID()`](/documentation/Security/SecCertificateGetTypeID()) Returns the unique identifier of the opaque type to which a certificate object belongs. ### Import and Export [Storing a DER-Encoded X.509 Certificate](/documentation/Security/storing-a-der-encoded-x-509-certificate) Import and export a certificate from a file. [`SecCertificateCreateWithData(_:_:)`](/documentation/Security/SecCertificateCreateWithData(_:_:)) Creates a certificate object from a DER representation of a certificate. [`SecCertificateCopyData(_:)`](/documentation/Security/SecCertificateCopyData(_:)) Returns a DER representation of a certificate given a certificate object. ### Certificate Components [Examining a Certificate](/documentation/Security/examining-a-certificate) Learn how to retrieve properties from a certificate. [`SecCertificateCopySubjectSummary(_:)`](/documentation/Security/SecCertificateCopySubjectSummary(_:)) Returns a human-readable summary of a certificate. [`SecCertificateCopyCommonName(_:_:)`](/documentation/Security/SecCertificateCopyCommonName(_:_:)) Retrieves the common name of the subject of a certificate. [`SecCertificateCopyEmailAddresses(_:_:)`](/documentation/Security/SecCertificateCopyEmailAddresses(_:_:)) Retrieves the email addresses for the subject of a certificate. [`SecCertificateCopyNormalizedIssuerSequence(_:)`](/documentation/Security/SecCertificateCopyNormalizedIssuerSequence(_:)) Retrieves the normalized issuer sequence from a certificate. [`SecCertificateCopyNormalizedSubjectSequence(_:)`](/documentation/Security/SecCertificateCopyNormalizedSubjectSequence(_:)) Retrieves the normalized subject sequence from a certificate. [`SecCertificateCopySerialNumberData(_:_:)`](/documentation/Security/SecCertificateCopySerialNumberData(_:_:)) Returns the certificate’s serial number. [`SecCertificateCopyKey(_:)`](/documentation/Security/SecCertificateCopyKey(_:)) Retrieves the public key for a given certificate. [`SecCertificateCopyShortDescription(_:_:_:)`](/documentation/Security/SecCertificateCopyShortDescription(_:_:_:)) Returns a copy of the short description of a certificate. [`SecCertificateCopyLongDescription(_:_:_:)`](/documentation/Security/SecCertificateCopyLongDescription(_:_:_:)) Returns a copy of the long description of a certificate. ### Detailed Certificate Information [Getting Certificate Values](/documentation/Security/getting-certificate-values) Obtain all the values associated with a certificate. [`SecCertificateCopyValues(_:_:_:)`](/documentation/Security/SecCertificateCopyValues(_:_:_:)) Creates a dictionary that represents a certificate’s contents. [Certificate OIDs](/documentation/Security/certificate-oids) Use OIDs as keys in the dictionary representing certificate values. [Certificate Property Keys](/documentation/Security/certificate-property-keys) Recognize the dictionary keys that taken together define a certificate property. [Certificate Property Type Values](/documentation/Security/certificate-property-type-values) Recognize the possible certificate property types. [Certificate Item Attribute Constants](/documentation/Security/certificate-item-attribute-constants) Use these four character values to indicate certificate item attributes. ### Certificate Names [`SecCertificateSetPreferred(_:_:_:)`](/documentation/Security/SecCertificateSetPreferred(_:_:_:)) Sets the certificate that should be preferred for the specified name and key use. [`SecCertificateCopyPreferred(_:_:)`](/documentation/Security/SecCertificateCopyPreferred(_:_:)) Returns the preferred certificate for the specified name and key usage. ### Legacy Symbols [`OpaqueSecCertificateRef`](/documentation/Security/OpaqueSecCertificateRef) [`SecCertificateAddToKeychain(_:_:)`](/documentation/Security/SecCertificateAddToKeychain(_:_:)) Adds a certificate to a keychain. [`SecCertificateCopyNormalizedIssuerContent(_:_:)`](/documentation/Security/SecCertificateCopyNormalizedIssuerContent(_:_:)) Returns a normalized copy of the distinguished name (DN) of the issuer of a certificate. [`SecCertificateCopyNormalizedSubjectContent(_:_:)`](/documentation/Security/SecCertificateCopyNormalizedSubjectContent(_:_:)) Returns a normalized copy of the distinguished name (DN) of the subject of a certificate. [`SecCertificateCreateFromData`](/documentation/Security/SecCertificateCreateFromData) Creates a certificate object based on the specified data, type, and encoding. [`SecCertificateCopyPreference`](/documentation/Security/SecCertificateCopyPreference) Retrieves the preferred certificate for the specified name and key use. [`SecCertificateGetAlgorithmID`](/documentation/Security/SecCertificateGetAlgorithmID) Retrieves the algorithm identifier for a certificate. [`SecCertificateGetCLHandle`](/documentation/Security/SecCertificateGetCLHandle) Retrieves the certificate library handle from a certificate object. [`SecCertificateGetData`](/documentation/Security/SecCertificateGetData) Retrieves the data for a certificate. [`SecCertificateGetIssuer`](/documentation/Security/SecCertificateGetIssuer) Unsupported. [`SecCertificateGetSubject`](/documentation/Security/SecCertificateGetSubject) Unsupported. [`SecCertificateGetType`](/documentation/Security/SecCertificateGetType) Retrieves the type of a specified certificate. [`SecCertificateSetPreference`](/documentation/Security/SecCertificateSetPreference) Sets the preferred certificate for a specified name, key use, and date. [`SecCertificateCopySerialNumber(_:)`](/documentation/Security/SecCertificateCopySerialNumber(_:)) Returns a copy of a certificate’s serial number. [`SecCertificateCopyPublicKey(_:)`](/documentation/Security/SecCertificateCopyPublicKey(_:)) Retrieves the public key from a certificate. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)