Set imported certificate to always be trusted in Mac OS X

Question

I have generated a certificate in pfx format in Mac os X and imported it into system keychain using:

sudo security import server.pfx -k /Library/Keychains/System.keychain -P foobar

The problem is that all trusts are set to no value specified.

How can I set trust for code signing to Always trust using command line.

Answer 1

Here's what worked for me, it's very close to that traveling beard's answer. I'm using trustAsRoot instead of trustRoot.

With this change, in the Keychain Viewer, my cert now has "Always Trust" set. When I used trustRoot, the cert is added but with "Use System Default" set and the system default is to Never Trust.

sudo security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain <certfile>

NOTE: The sudo will prompt for a password on the commandline and the gui will also prompt.

Nice, now I can import a dev cert on the command line with only a sudo passwd and not have to open that GUI!!

Answer 2

The -p option may be what you need. It can be specified more than once for each of the settings. I wish I knew how to deny one specific item while trusting another all in the same line.

sudo security add-trusted-cert -d -r trustRoot -p [option] -k /Library/Keychains/System.keychain <certificate>

-p options are ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, timestamping, eap