Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Keychain Access it looks like you can only untrust/delete certificates one at a time.

But there are a lot of certificates I want to get rid of. How can I take care of them all at the same time?

Also, what are the minimum certificate requirements? Is it possible to make the system unusable by untrusting a certificate?

share|improve this question

If You want to change set of system root certificates, they are in /System/Library/Keychains/. Example of using security there is in this answer to similar question.

share|improve this answer

You can script keychain events from the command line with the security command. On Lion and earlier, the worst that will happen if you delete all the system roots is you won't be able to run software update or use iTunes and other applications that interface with secure web services.

It might be easier just to make a keychain file you like and shove that in place of the ones Apple provides and watch for changes when you do apply software updates.

share|improve this answer
security list-keychain doesn't list the system roots keychain. How can I access that? Is it OK to delete everything in there? – z-buffer Jun 2 '12 at 23:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.