Michael, I did add the entire certificate chain but not to the keychain called System. Now I did as you advised and indeed, it works! Thanks a lot, Stephan Michael Kluskens schrieb:

Stephan,

I don't see where you added certificates to the System Keychain, that was the problem I had. It's barely documented anywhere, but there are references to needing the entire certificate chain in the System Keychain. So if the login certificate is signed by A, then A needs to be in the System Keychain, etc.

Michael Kluskens