Use command-line security tool instead of opening Keychain Access
Remove ruby_path from generator
Create agent in /Library/LaunchDaemons so it runs as root and can thus bind to port 443