macOS runner: "SecKeychainItemImport: One or more parameters ... not valid" in CI
security import rejected the certificate file. The most common cause in CI is a wrong .p12 passphrase or a base64 secret that was corrupted on the way in, so the data passed to SecKeychainItemImport is not valid.
What this error means
A security import step fails with "SecKeychainItemImport: One or more parameters passed to a function were not valid." or "MAC verification failed during PKCS12 import (wrong password?)".
security: SecKeychainItemImport: One or more parameters passed to a function were not valid.Common causes
Wrong passphrase for the .p12
The password passed with -P does not match the one the .p12 was exported with, so PKCS12 verification fails and the import is rejected.
The certificate secret was decoded incorrectly
A base64-encoded secret decoded with the wrong flags or trailing whitespace produces a malformed file that import cannot parse.
How to fix it
Decode the secret cleanly and pass the right password
- Store the .p12 as a base64 secret and decode it without extra whitespace.
- Pass the exact export passphrase with
-P. - Import with the codesign tool allowed.
echo "$CERT_BASE64" | base64 --decode > cert.p12
security import cert.p12 -k build.keychain -P "$P12_PW" -T /usr/bin/codesignVerify the .p12 integrity
Confirm the decoded file is a valid PKCS12 and that the passphrase matches before importing.
openssl pkcs12 -info -in cert.p12 -noout -passin pass:"$P12_PW"How to prevent it
- Store the .p12 as base64 and decode without altering bytes.
- Keep the export passphrase in a secret and pass it with
-P. - Validate the .p12 with openssl before importing in CI.