16

The Apple keychain application will not let you remove system roots, it will only allow you to disable them. It will only allow you to disable them one at a time. For each one, you need to go through 3 UI panels and type your password. Is there a way to either automate this or do it all at once? I do not like Apple's current selection of system roots.

Improve this question
5
  • I can't give you an answer/solution, but I can suggest you re-think this. What do you hope to accomplish/What is your goal? What are the advantages of doing this? What are the disadvantages of doing this? If it is just a matter of wanting to clean up Keychain, I'd forget it. Altering ANYTHING dealing with "system" can lead to problems, and is generally not recommended. It's one of those "if it ain't broke, don't fix it" situations.
    – modelamac
    Sep 10, 2011 at 11:29
  • 5
    My goal is to remove trusted roots from organizations that I don't trust. I do not trust the government of China. I don't trust the compromised certs from the Netherlands. I don't trust certs from a whole bunch of other organizations. I don't want them. Why should I trust all of those organizations? I don't.
    – vy32
    Sep 10, 2011 at 20:54
  • 3
    I'm looking to find/develop a good list of certs not to trust, and their hashes, which would be handy for distrusting 'em. Seems to me like a good idea to distrust ones not seen regularly outside specialized niches. Maybe netcraft has a list of widely used CAs developed via their survey to determine which are widely used. I'm betting that with around a dozen CAs, I'd have the top 500 sites and all the sites I visit regularly covered. vy32, I'm curious if you have your list of certs you decided not to trust, and why you selected them. Can you share? Also,
    – MrE
    Apr 30, 2012 at 23:02
  • How do you find out which certificate belongs to which application?
    – Ruskes
    May 17, 2013 at 15:31
  • Certificates don't belong to applications. They belong to the system.
    – vy32
    May 17, 2013 at 22:39

4 Answers 4

Reset to default
16

Backup keychain before trying anything.

Listing root certificates:

sudo security dump-keychain /System/Library/Keychains/SystemRootCertificates.keychain

Just look in a dump for a names or SHA-1 hash values of certificates that you want to get rid of and write them down.

Now you can delete that root certificates using security delete-certificate command.

Usage: delete-certificate [-c name] [-Z hash] [-t] [keychain...]

-c  Specify certificate to delete by its common name
-Z  Specify certificate to delete by its SHA-1 hash value
-t  Also delete user trust settings for this certificate The certificate to be deleted must be uniquely specified either by a

string found in its common name, or by its SHA-1 hash. If no keychains are specified to search, the default search list is used.

For example you can delete chinese root certificates using this command: 

sudo security delete-certificate -Z 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F /System/Library/Keychains/SystemRootCertificates.keychain
Improve this answer
2
  • 4
    When the list of root certificates is dumped under what attribute do I find the SHA-1 hash value?
    – BrightIntelDusk
    Jan 25, 2015 at 4:25
  • 1
    @BrightIntelDusk you can use the following command: sudo security find-certificate -a -c startcom -Z /System/Library/Keychains/SystemRootCertificates.keychain
    – lifeofguenter
    Jun 9, 2018 at 10:03
1

Thank You! Worked for me with the -c option. Find the name of the root certificate in Keychain.app, then sudo security delete -c "CERTNAME" /System/Library/Keychains/SystemRootCertificates.keychain If you keep Keychain.app open with that certificate in view, you notice it immediately deletes when executing the command in terminal.

Improve this answer
0

Distrust of a root with delete-certificate by hash is broken: sudo security delete- certificate -Z 8250BED5A214433A66377CBC10EF83F669DA3A67 / System/Library/Keychains/SystemRootCertificates.keychain This always fails with: “security: SecKeychainItemDelete: UNIX[Operation not permitted]” even if this referenced certificate is present.

Here's a workaround from a talk at DEFCON24.

Instead save the root certificate as a cer file and use: security add-trusted-cert -d -r deny -k "/Library/Keychains/System.keychain" certname.cer

Improve this answer
0
  1. Open Keychain Access app (/Applications/Utilities/Keychain Access.app)
  2. Select System Roots in keychains
  3. Select Certificates in category
  4. Search for the expired certificate's name
  5. Right click on the certificate then select "Delete"
  6. Enter system admin password
Improve this answer
1
  • 1
    This does not work anymore since el capitan due to system integrity protection. However you can choose not to trust.
    – Antzi
    Sep 28, 2016 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .