I am working on a way to import a RootCA into the login keychain of OS X and set it to always trust, the cert is located on a file share server.

I am relatively new to the whole Bash scripting scene and have been actively researching this issue for a few weeks now with some success. I have been able to import and trust a RootCA locally, but unable to reach out to a server and import the cert.

Here is what I currently have:

sudo security add-trusted-cert -d -r trustAsRoot -k $HOME/Library/Keychains/login.keychain $HOME/Desktop/rootCA

When I replace "$HOME/Desktop/rootCA" with my server path, I get prompted for a password, then receive a message:

Error reading file "Server path"

I have tried to SSH to the server and have been greeted with "Connection refused on port 22"... I don't have access to manage this server either.

Any thoughts?

  • security can't read the cert and keychain file from a remote server, it can only read them from local disk. You don't say what "Server path" is in your output specifically -- is it an standard file system path to an NFS mount? An afs path? It has to be a path to a local file. – Ian C. Feb 19 '15 at 21:46
  • Oh, so I cannot pull a cert from a remote server and add it to keychain via BASH? Is it possible to download the cert to a temporary folder and then import to the keychain? Same script, but separate lines? – Tanner17 Feb 20 '15 at 15:08
  • You can "pull it", you just can't do it in one line. You could use ssh to extract it from the remote machine's keychain, save it to a file and then scp it to the machine where you want to import it. – Ian C. Feb 20 '15 at 16:08
  • Ok, so the certificate is located on a Windows server, will that cause any issues? – Tanner17 Feb 20 '15 at 17:25
  • Probably. Remote access to Windows machines sucks. You need a way to pull it, remotely, from that machine to your Mac. That's probably a whole question unto itself. – Ian C. Feb 20 '15 at 17:26

You must log in to answer this question.

Browse other questions tagged .