Introduction

When Xcode or the codesign tool reports "The specified item could not be found in the keychain," it means the code signing identity your build expects cannot be located. This typically happens because the signing certificate, its private key, or both are missing from the keychain macOS is searching. Understanding exactly what is missing and why lets you fix the problem quickly instead of guessing through reinstallation steps.

What the Error Means

Code signing on macOS requires two things stored together in a keychain: a signing certificate (which contains the public key and identity information) and its corresponding private key. When Xcode resolves a signing identity like "Apple Distribution: Your Company (TEAMID)," it searches the keychain for a certificate matching that name and a private key that pairs with it. If either piece is missing, you get this error.

The certificate alone is not enough. Apple's Developer portal lets you download certificates, but the private key is generated locally on the machine that created the Certificate Signing Request (CSR). If you set up signing on a different machine, you need the exported .p12 file that contains both the certificate and the private key together.

Common Causes

Expired certificate. Apple signing certificates expire after one year (development) or three years (distribution). Once expired, Xcode cannot use them and may report them as not found rather than expired.

Revoked certificate. If someone on your team revoked the certificate in the Apple Developer portal, the local copy becomes invalid. Xcode treats it as unusable.

Missing private key. This is the most common cause. You downloaded the certificate from the Developer portal, but the private key that was used to generate the original CSR lives on a different machine. Without the private key, the certificate cannot be used for signing.

Wrong keychain. macOS can have multiple keychains. The certificate might be in the System keychain while Xcode is searching the login keychain, or vice versa.

Keychain is locked. If the keychain containing the certificate is locked (common in CI environments after a reboot), macOS cannot access its contents.

Fixing the Problem Locally

Step 1 -- Check What You Have

Open Keychain Access (Applications > Utilities > Keychain Access) and search for your signing certificate. Expand the certificate entry. If you see a private key nested underneath it, the pair is intact. If the private key is missing, that is your problem.

1# List signing identities visible to codesign
2security find-identity -v -p codesigning
3
4# Look for the specific certificate
5security find-certificate -a -c "Apple Distribution" -Z login.keychain-db

Step 2 -- Re-download or Import the Certificate

If the certificate is missing entirely, download it from the Apple Developer portal:

1. Go to https://developer.apple.com/account/resources/certificates/list
2. Find your certificate and click Download.
3. Double-click the .cer file to install it into the login keychain.

If the private key is missing, you need the .p12 export from the machine that originally created the CSR:

# Import a .p12 file into the login keychain
security import certificate.p12 -k ~/Library/Keychains/login.keychain-db -P "your-password" -T /usr/bin/codesign

Step 3 -- Create a New Certificate If Needed

If you cannot recover the private key, revoke the old certificate in the Developer portal and create a new one:

1. In the Developer portal, revoke the old certificate.
2. In Xcode, go to Settings > Accounts > Manage Certificates.
3. Click the + button to create a new certificate of the appropriate type.
4. Xcode generates a new CSR and private key locally and registers the certificate with Apple.

Step 4 -- Reset Keychain as a Last Resort

If the keychain itself is corrupted:

1# Reset the default keychain (WARNING: this deletes all keychain items)
2security delete-keychain login.keychain-db
3security create-keychain -p "" login.keychain-db
4security default-keychain -s login.keychain-db
5security set-keychain-settings login.keychain-db

This is destructive. Only do this if other approaches fail and you have backups of your certificates and passwords.

CI/CD Keychain Setup

On CI servers (GitHub Actions, Jenkins, CircleCI), there is no interactive keychain. You must create a temporary keychain, import the certificate, and configure it for non-interactive use.

1# Define variables
2KEYCHAIN_NAME="build.keychain-db"
3KEYCHAIN_PASSWORD="ci-temp-password"
4
5# Create a new keychain
6security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
7
8# Add it to the search list so codesign can find it
9security list-keychains -s "$KEYCHAIN_NAME" $(security list-keychains | tr -d '"')
10
11# Unlock the keychain
12security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
13
14# Prevent the keychain from auto-locking (important for long builds)
15security set-keychain-settings -t 3600 -u "$KEYCHAIN_NAME"
16
17# Import the .p12 certificate (stored as a CI secret, base64-encoded)
18echo "$P12_BASE64" | base64 --decode > /tmp/cert.p12
19security import /tmp/cert.p12 -k "$KEYCHAIN_NAME" -P "$P12_PASSWORD" \
20  -T /usr/bin/codesign -T /usr/bin/security
21
22# Allow codesign to access the keychain without a prompt
23security set-key-partition-list -S apple-tool:,apple:,codesign: \
24  -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
25
26# Clean up
27rm /tmp/cert.p12

The set-key-partition-list command is critical and frequently overlooked. Without it, codesign will fail with a keychain access error even though the certificate is imported.

Verifying the Fix

After importing or recreating your certificate, verify that signing works:

1# List all valid signing identities
2security find-identity -v -p codesigning
3
4# Try signing a test binary
5codesign -s "Apple Distribution: Your Company (TEAMID)" --force /path/to/your.app

If the identity appears in the list and the test sign succeeds, the problem is resolved. In Xcode, do a clean build (Product > Clean Build Folder) before rebuilding.

Common Pitfalls

• Forgetting the private key: Downloading just the .cer file from the Developer portal is not enough. You must have the matching private key, which only exists on the machine that created the CSR or in an exported .p12 file.
• Not unlocking the keychain in CI: After creating a keychain on a CI server, you must explicitly unlock it. A locked keychain causes the "item not found" error even when the certificate is present.
• Skipping set-key-partition-list: On macOS Sierra and later, imported keys require an explicit partition list to allow codesign access. Without this step, CI builds fail silently.
• Having duplicate certificates in multiple keychains: If the same certificate exists in both the login and System keychains but only one has the private key, codesign may find the wrong one. Remove duplicates to avoid ambiguity.
• Ignoring certificate expiration: Certificates expire silently. Set a calendar reminder or use security find-certificate -c "Apple" -p | openssl x509 -noout -enddate to check expiration dates proactively.

Summary

• The "specified item could not be found in the keychain" error means the signing certificate or its private key is missing from the keychain macOS is searching.
• The most common fix is importing a .p12 file that contains both the certificate and private key together.
• If the private key is lost, revoke the old certificate in the Apple Developer portal and create a new one through Xcode.
• For CI/CD, create a temporary keychain, import the .p12, unlock it, and run set-key-partition-list to grant codesign access.
• Always verify the fix by running security find-identity -v -p codesigning to confirm the signing identity is visible.