How to change the policy value of a CA identity in apple keychain? According to this guide, I made an intermediate CA, and successfully used it to sign app in Windows. However, after converted it into a Apple keychain (by this guide), this CA become having an "iChat" policy, which cannot be used to code signing:

$ security find-identity -p ichat /path/to/my_keychain
Policy: iChat
  Matching identities
  1) XXXXXXXXXXXXXXX "my_identity" (CSSMERR_TP_NOT_TRUSTED)
     1 identities found

  Valid identities only
  1) XXXXXXXXXXXXXXX "my_identity" (CSSMERR_TP_NOT_TRUSTED)
     1 identities found


So, how to make it to have "codesigning" policy? Thanks for a lot!

====

Yesterday I tried some more works. After reading the x509v3_config manual, I modified the CA generation, and the resultant intermediate CA has following attributes:

$ openssl x509 -in my_cert.pem -noout -text
Certificate:
    ......
    X509v3 extensions:
        X509v3 Subject Key Identifier:
            ......
        X509v3 Authority Key Identifier:
            keyid:......

        X509v3 Basic Constraints: critical
            CA:TRUE, pathlen: 0
        X509v3 Key Usage: critical
            Digital Signature, Certificate Sign, CRL Sign
        X509v3 Extended Key Usage:
            Code Signing
......


And I re-generated the keychain file:

$ rm my_keychain
$ certtool i my_cert.pem k=`pwd`/my_keychain r=my_private_key.pem c


However, the CA in keychain is still recognized to only have iChat policy.
In Keychain Access.app highlight the certificate, then "Get Info" ( ⌘ i ):


  Under "Trust" select "Code Signing" > "Always Trust"