Creating FileVaultMaster.keychain from the command line

In FileVault 2, if you want to set a recovery key on multiple machines, you need to create and configure a FileVaultMaster keychain. Prior to 10.7.2, this was a process that you could only perform in the GUI. 10.7.2 introduces a way to create this keychain using the security command.

To create a FileVaultMaster.keychain, run the following command:

security create-filevaultmaster-keychain /path/to/FileVaultMaster.keychain



(If you want to create the FileVaultMaster keychain in its proper place, use /Library/Keychains for the destination path.)

You’ll be prompted for a password for the keychain. Use the password that you’ll be setting as your Master Password here. At this point, the keychain will contain both the private and public keys needed for FileVault recovery. Make copies of the keychain and store them in a safe place.

Once you’ve made your copies, make another copy and remove the private key from that copy of the keychain. Once the private key is removed, the FileVaultMaster.keychain is ready to be used for encrypting Macs with FileVault 2.

It doesn’t appear that the security man page has been updated with information about this new option, but you can see what it does by running security help and checking at the bottom of the list that appears.