Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Apple keychain application will not let you remove system roots, it will only allow you to disable them. It will only allow you to disable them one at a time. For each one, you need to go through 3 UI panels and type your password. Is there a way to either automate this or do it all at once? I do not like Apple's current selection of system roots.

share|improve this question
I can't give you an answer/solution, but I can suggest you re-think this. What do you hope to accomplish/What is your goal? What are the advantages of doing this? What are the disadvantages of doing this? If it is just a matter of wanting to clean up Keychain, I'd forget it. Altering ANYTHING dealing with "system" can lead to problems, and is generally not recommended. It's one of those "if it ain't broke, don't fix it" situations. – modelamac Sep 10 '11 at 11:29
My goal is to remove trusted roots from organizations that I don't trust. I do not trust the government of China. I don't trust the compromised certs from the Netherlands. I don't trust certs from a whole bunch of other organizations. I don't want them. Why should I trust all of those organizations? I don't. – vy32 Sep 10 '11 at 20:54
I'm looking to find/develop a good list of certs not to trust, and their hashes, which would be handy for distrusting 'em. Seems to me like a good idea to distrust ones not seen regularly outside specialized niches. Maybe netcraft has a list of widely used CAs developed via their survey to determine which are widely used. I'm betting that with around a dozen CAs, I'd have the top 500 sites and all the sites I visit regularly covered. vy32, I'm curious if you have your list of certs you decided not to trust, and why you selected them. Can you share? Also, – MrE Apr 30 '12 at 23:02
How do you find out which certificate belongs to which application? – Buscar웃 May 17 '13 at 15:31
Certificates don't belong to applications. They belong to the system. – vy32 May 17 '13 at 22:39
up vote 11 down vote accepted

Backup keychain before trying anything.

Listing root certificates:

sudo security dump-keychain /System/Library/Keychains/SystemRootCertificates.keychain

Just look in a dump for a names or SHA-1 hash values of certificates that you want to get rid of and write them down.

Now you can delete that root certificates using security delete-certificate command.

Usage: delete-certificate [-c name] [-Z hash] [-t] [keychain...]

-c  Specify certificate to delete by its common name
-Z  Specify certificate to delete by its SHA-1 hash value
-t  Also delete user trust settings for this certificate The certificate to be deleted must be uniquely specified either by a

string found in its common name, or by its SHA-1 hash. If no keychains are specified to search, the default search list is used.

For example you can delete chinese root certificates using this command:

sudo security delete-certificate -Z 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F /System/Library/Keychains/SystemRootCertificates.keychain
share|improve this answer
When the list of root certificates is dumped under what attribute do I find the SHA-1 hash value? – BrightIntelDusk Jan 25 '15 at 4:25

Thank You! Worked for me with the -c option. Find the name of the root certificate in, then sudo security delete -c "CERTNAME" /System/Library/Keychains/SystemRootCertificates.keychain If you keep open with that certificate in view, you notice it immediately deletes when executing the command in terminal.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.