In Keychain Access it looks like you can only untrust/delete certificates one at a time.

But there are a lot of certificates I want to get rid of. How can I take care of them all at the same time?

Also, what are the minimum certificate requirements? Is it possible to make the system unusable by untrusting a certificate?

2 Answers 2


If You want to change set of system root certificates, they are in /System/Library/Keychains/. Example of using security there is in this answer to similar question.


You can script keychain events from the command line with the security command. On Lion and earlier, the worst that will happen if you delete all the system roots is you won't be able to run software update or use iTunes and other applications that interface with secure web services.

It might be easier just to make a keychain file you like and shove that in place of the ones Apple provides and watch for changes when you do apply software updates.

  • security list-keychain doesn't list the system roots keychain. How can I access that? Is it OK to delete everything in there?
    – z-buffer
    Jun 2, 2012 at 23:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .