Keychains – which contain passwords, security certificates, encryption keys, and even secure notes if you wish – are normally fairly stable and robust. But every once in a while, a Mac seems to run into problems with them. Most common is having to keep entering your keychain password, because that keychain seems to lock itself when you’re not looking.

I also remember one particular update to macOS which seemed to cause widespread keychain problems. I am sure that is a thing of the past.

For a long time now, Apple has provided a bundled utility, Keychain Access, which lets us view and alter our keychains. Some time ago, there was a separate tool called Keychain First Aid, which we could run to check and repair wobbly keychains. Then Apple decided to integrate that into Keychain Access: to check and repair a keychain, you then had to open Keychain Access, and run First Aid from its app menu.

Keychain First Aid quietly disappeared at the end of last year, with the 10.11.2 update.

This was apparently because of a security vulnerability, in which malicious software could pose as a keychain component, and create havoc. Not that it ever seems to have been exploited, though.

Apple did sort of tell us, in the security information which accompanied the 10.11.2 update. As I keep records, I can quote the exact words:
Keychain Access
Available for: OS X El Capitan v10.11 and v10.11.1
Impact: A malicious application may be able to masquerade as the Keychain Server.
Description: An issue existed in how Keychain Access interacted with Keychain Agent. This issue was resolved by removing legacy functionality.

The peculiar absence of the words “Keychain First Aid” may of course have been a clerical oversight. Neither can I find any Apple Knowledgebase article explaining this, nor (unsurprisingly) any release notes.

Rumour has it, according to a reported conversation with someone from Apple Support, that Disk Utility now performs keychain checks and repairs if necessary. I cannot confirm this, which may be completely untrue. There doesn’t appear to be any command line tool with an option to perform keychain checking and repair. Maybe Keychain First Aid hasn’t done anything useful for years, and it was just a placebo.

So all that I can suggest, if you are running macOS 10.11.2 or later and are experiencing keychain problems, is to open Disk Utility and run First Aid on your startup volume.

It’s anyone’s guess as to whether that will actually do anything, though.

If it doesn’t, then you can try creating a new, empty keychain, and copying across all the contents of the old one. That may, of course, not work if you have problems with the old keychain, which is why you are doing all this in the first place.

If you have discovered a solution, please let me know.

Postscript: additional and updated information about dealing with keychain problems in macOS Sierra is now provided in this article.