Background info: I am working on an OS X server, and I need to use certificates from the key chain with openssl smime in order to encrypt messages in a bash script. In order to do so, I use the
security find-certificate with the
-e option to extract the certificates for a certain email address from the OS X key chain. This works well, however, the command extracts all certificates which are found for that email address to the PEM file. The file will even contain expired certificates.
When I use the PEM file for mail encryption with
openssl smime, obviously only the first certificate in the PEM file is used.
So what needs to be done is to select the certificate with the highest expiration date from the PEM file, so I can use that one with openssl, but how can this can be done?