I succeeded importing a root CA to the keychain with

sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" CA.crt

But it's marked as Use System Defaults, like

enter image description here

How can I mark it as Always Trust from CLI?

  • I just spent an hour. Looks like a bug to me.
    – bot47
    Commented Nov 17, 2015 at 17:06

3 Answers 3


It seems that the only way to modify the trust settings via the security command is by the trust-settings-import option. The xml file output by security trust-settings-export would be a good place to start; but, it looks a little tricky.


Probably your root CA certificate is malformed, as your method works for me. Maybe your CA root certificate has not been generated with the expected properties. Try with -r trustAsRoot in your case, but I recommend to check your certificate generation.


To add CA certificate to trust store and mark it as trusted, use the -p options to specify the usage:

sudo security add-trusted-cert -d -r trustRoot -p ssl -p codeSign -k /Library/Keychains/System.keychain CA.crt

Here -p specifies policy constraint options:

-p policy - Specify policy constraint which can be:

ssl, smime, codeSign, IPSec, iChat,basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .