Supplement

Supplement: My application includes MacApp(UI) and XPC Daemon. MacApp and XPC Daemon will be restarted by the system at the same time. I did more tests: [Test A] Manually unload XPC Daemon After a long time, XPC Daemon is still activated by system. When Daemon is restarted, MacApp will also be restarted by the system... Then MacApp can’t found the certificate.😢 [Test B] Create another App, only timed query certificate. It will not be restarted, so the certificate can be found.✅

Supplement 2: I use the following API to get the keychain search list. When my app is restarted by the system, "Domain User Search List" is empty. So I can't find Certificate. CFArrayRef debugSearchList = NULL; OSStatus debugStatus = SecKeychainCopySearchList(&debugSearchList); LOGD(@"[DEBUG] %d CopySearchList = %@", debugStatus, debugSearchList); CFArrayRef searchList = NULL; OSStatus statusDomainUser = SecKeychainCopyDomainSearchList(kSecPreferencesDomainUser, &searchList); LOGD(@"Copy kSecPreferencesDomainUser SearchList (%d) = %@", statusDomainUser, searchList); Normal [DEBUG] 0 CopySearchList = ( "<SecKeychain 0x7f99b7d28280 [0x7fff8076db70]>", "<SecKeychain 0x7f99b7d289b0 [0x7fff8076db70]>", "<SecKeychain 0x7f99b7d291f0 [0x7fff8076db70]>" ) Copy kSecPreferencesDomainUser SearchList = ( "<SecKeychain 0x7f99b7d28280 [0x7fff8076db70]>" ) Restarted by the system [DEBUG] 0 CopySearchList = ( "<SecKeychain 0x7fac7f529190 [0x7fff8076db70]>", "<SecKeychain 0x7fac7f5298c0 [0x7fff8076db70]>" ) Copy kSecPreferencesDomainUser SearchList = ( )

After I check system log, found that "relaunch issue" is caused by UEM/MDM. => The 'mdmclient' reinstalls my application, scripts will kill the running program. <<MDM reinstall>> 15:00:18.512454 mdmclient Processing install phase 1 for… <<Relaunch App>> 15:00:26.596707 MobileIron Authenticate void checkArguments(NSArray<NSString *> *__strong) <<Relaunch Daemon>> 15:00:26.626379 MiDaemon int main(int, const char **) [DAEMON] main (without UI) ◻️◻️◻️◻️◻️◻️◻️◻️◻️ Another issue - 「App started by the system cannot find the Certificate in the Keychain」 I still don’t know why, but found a solution. Just use 'SecKeychainOpen' to open the user keychain file (~/Library/Keychains/login.keychain-db), and it can be used normally.