On macOS I am creating a public/private key pair (ECDSA 256), will be secure enclave in the long run, just trying to baseline some functionality right now using file store (currently running in a system daemon). I can sign data using the private key with no problem, and export the public key. However, after generating a cert chain via CSR externally, I’m trying to figure out the proper incantation to import that cert/chain and have it recognized as matching the existing private key, but so far I can’t figure out the correct attributes to get it to pair up. Do you have any sample code that might have the right SecAddItem (or such) calls that would make this work as expected?

On macOS (I have 12.3.1) I cannot import certificates into the keychain that have RSA-PSS keys; I get an invalid algorithm error. However, I can import certificates into the keychain that are signed by an issuer using an RSA-PSS signature algorithm. Is there anything need to enable this functionality? On Windows 10 the same certs can be imported into the certificate store with no problem.