我能够使用此工具chainbreaker从 macOS High Sierra 10.13.6 中提取不可提取的私钥。它需要Python2withhexdump和pycrypto包。该工具的 repo 中的这个 README 文件解释了如何执行该README-keydump.txt。

一般来说：

sudo pip2 install hexdump pycrypto pyOpenSSL

git clone https://github.com/n0fate/chainbreaker

cd chainbreaker

python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p 'YOUR_KEYCHAIN_PASS'

# After the command has finished running, there will be a new folder
# exported with 3 more folders for certs, keys and key-cert pairs
ls exported/associated

# This will show you folders with found key-certificate pairs as numbered
# subfolders and separate files there. Those files are in DER format, so,
# for example, to convert those to PEM:
openssl x509 -inform DER -in exported/associated/1/3.crt -out exported/associated/1/cert.pem
openssl rsa -inform DER -in exported/associated/1/5.key -out exported/associated/1/key.pem

显然，开源安全框架有一个检查关键属性是否设置为不可导出。覆盖这些属性会起作用。您还可以尝试使用调试器运行您的 VPN/浏览器，并中断使用该密钥的功能。从那里您可以获得指向内存的指针并提取私钥。

lldb -- security export -k test.keychain -o asdf -w
break impExpWrappedKeyOpenSslExport

根据https://reverseengineering.stackexchange.com/questions/6043/extract-non-extractable-private-key-from-os-x-keychain，OS X 10.5 似乎不支持kSecAttrIsExtractable字典键和CSSM_KEYATTR_EXTRACTABLE位。

因此，似乎可以将 login.keychain 从 OS X 10.9 复制到 10.5，并执行 p12 导出。