I was trying to add a trusted cert using security add-trusted-cert -d ..., but somehow the Trust Settings Record became corrupted. I can see this whenever I try to add another trusted cert, or when dumping trust settings:

$ sudo security dump-trust-settings -d
SecTrustSettingsCopyCertificates: The Trust Settings Record was corrupted.

I tried restoring the keychain from backup, and then deleting the login keychain completely, but I still get the error. This makes me think the trust settings are stored in another db or something. Any ideas on how I can delete all the trust settings?

1 Answer 1


I finally found the Admin trust settings. It's in a file called Admin.plist in the /Library/Security/Trust Settings directory. Deleting this file cleared the error!

There are other files in that directory that are named <UUID>.plist, where UUID is the value of the GeneratedUID key in the user record. You can see this value with this command:

dscl . cat /Users/<short login name> GeneratedUID`

These files store the per-user trust settings.

  • Thanks! I was following a SignalR tutorial (docs.microsoft.com/en-us/aspnet/core/tutorials/…), and ran into this error. On the console, I got: "warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35] No XML encryptor configured. Key {...} may be persisted to storage in unencrypted form.", and in Chrome, an error that the connection wasn't secure. The steps in the article to gen dev certificate didn't work until I deleted Admin.plist. Thanks again! Commented Nov 13, 2021 at 22:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .