macOS Keychain Error -25294 (errSecNoSuchKeychain) — Fixed by Importing the Certificate into login

You try to import a certificate into Keychain Access on macOS and get error -25294, and the import fails. Double-clicking the certificate file just stalls with a complaint that it cannot find a place to put it. Here is the short version: in my case, switching the destination keychain from Local Items to login fixed it immediately. For anyone hitting the same symptom, here is what is actually going on and the shortest path to a fix.

Error -25294 is errSecNoSuchKeychain

First, what is -25294? It is a macOS Keychain error code that maps to errSecNoSuchKeychain. It means exactly what it says: “the specified keychain could not be found.” It corresponds to the old Keychain Manager error code errKCNoSuchKeychain = -25294 and is defined as one of the Security framework result codes.

The key thing to understand is that this error does not indicate that the certificate itself is broken. What the message refers to is not the certificate but the destination keychain it was trying to import into. The certificate’s bytes can be perfectly fine, yet if the keychain it is being written to is not correctly specified or recognized, macOS reports that no such keychain exists and returns -25294. So the first thing to suspect is not a corrupt download but the import destination.

The usual cause is the destination keychain

When this error shows up, the most common cause by far is that Keychain Access has defaulted the destination to a keychain that cannot hold the certificate, or one that does not exist. Concretely, these are the cases:

The destination is set to “Local Items.” This refers to the data-protection keychain that syncs with iCloud, and even though it can hold certificates, its import code path is different, which is known to trigger this error easily. Apple appears to recognize it as a bug
The destination is set to the “iCloud” keychain. Like Local Items, it is a destination that tends to fail on certificate import
The login keychain or the default keychain configuration itself is broken

The first case is exactly the one that tripped me up. When I double-clicked the certificate file, Keychain Access silently picked “Local Items” as the destination, and it stalled right there with -25294.

How to fix it

The most reliable approach is to not double-click the certificate file, and instead choose the destination keychain yourself. Open Keychain Access, and from the menu choose File > Import Items. In the file picker dialog, open “Options,” which reveals a dropdown for selecting the destination keychain, and choose “login” (or “System”) here. Avoid Local Items and iCloud.

In my case this solved it. Left to a double-click, Keychain Access had been choosing Local Items; simply re-selecting login at import time made -25294 disappear, and the certificate imported normally. Reports of “re-selecting login fixed it” show up elsewhere too, so this is the first step I would recommend trying.

Import it directly on the command line

If the GUI insists on picking the wrong keychain, or if you would rather not go through the GUI at all, importing directly with the security command is quick. You specify the destination as an argument, so there is no chance of the wrong keychain being chosen.

# Import the downloaded .cer into the login keychain
security import ~/Downloads/DeveloperIDCA.cer -k ~/Library/Keychains/login.keychain-db
 
# Inspect the current keychain configuration
security list-keychains
security default-keychain

If the output of security default-keychain does not point at the login keychain, you can reset the default like this:

security default-keychain -s ~/Library/Keychains/login.keychain-db

Isolate a corrupted keychain

If none of the above works, suspect that the login keychain itself is corrupted. Apple’s Developer Technical Support recommends a diagnostic of creating a fresh user account and trying the import there. If it succeeds in the new account, you know the original account’s login keychain is broken; if it fails there too, you can isolate the problem to the certificate or the system instead. Once you have narrowed the cause down to the login keychain, the path forward, such as rebuilding the keychain, becomes clear.

Check whether a manual import is needed at all

One last note. If the certificate you are trying to import in this situation is an Apple-distributed intermediate certificate such as the “Developer ID Certification Authority,” a manual import may not even be required. If you have Xcode or the Command Line Tools installed via xcode-select --install, the intermediate certificate is often referenced automatically during signing and notarization.

In other words, the shortest route depends on why you are trying to install the certificate. If you are stuck on app signing or notarization, first check whether the error still reproduces with Xcode and the Command Line Tools installed. Sometimes you will find the manual import was unnecessary in the first place.

Wrapping up

Error -25294 (errSecNoSuchKeychain) is not “the certificate is broken” but “the destination keychain could not be found.” Most of the time the cause is that Keychain Access has defaulted the destination to Local Items or iCloud. The fix, in order: first, explicitly re-select login as the destination at import time; if that fails, import via the command line with an explicit destination; and if it still fails, use a fresh account to isolate a corrupted login keychain. For me, the very first option, switching from Local to login, did it. Before you re-fetch the certificate, suspect the destination first.

That’s all from solving the -25294 error by importing the certificate into login, from the Gemba.