Hi, so far i've been using the following API Call Sequence in order to check the keychain status prior to using one of the certificates inside the keychain for signing or verifying remote tls connection.
// Step 1: Open keychain
SecKeychainRef keychain = nil;
OSStatus status = SecKeychainOpen(keychainPath, &keychain);
// Result: errSecSuccess (0) — always succeeds, returns valid ref
// Step 2: Get keychain status
SecKeychainStatus keychainStatus = 0;
status = SecKeychainGetStatus(keychain, &keychainStatus);
// Result: FAILS : see table below
I observed SecKeychainGetStatus return errSecInternalError or errSecInvalidHandle
│ Process │ Keychain │ Error │ Code │
│ GUI App │ login.keychain. | errSecInternalError │ -26276 │
│ GUI App │ login.keychain | errSecInvalidHandle │ -25308 │
│ GUI App │ /Library/Keychains/System.keychain | errSecInvalidHandle │ -25308 │
│ Daemon │ /Library/Keychains/System.keychain │ errSecInvalidHandle │ -25308 │
- SecKeychainOpen always returns errSecSuccess with a non-null SecKeychainRef
- SecKeychainGetStatus fails immediately when called on that reference
- The error for login.keychain varies between calls (not deterministic)
- The error for System.keychain is consistently errSecInvalidHandle
- Issue is 100% reproducible. every keychain access attempt fails
- Started immediately after macOS 26.6.2 upgrade
Do you know if there were any changes in 26.6.2 that could have caused this behavior? If this is expected, how should I address it?
Thanks