~/Library/Keychains/login.keychain

Only exists when a user is logged in and only for that particular user so when you run it as a policy it will probably not work, Self Service will definitely have a logged in user and is probably managing to work out what ~ means.
You will either need to loop through all the users some how if you want it for everyone or use a login triggered policy and detect the user with something like.

Current_User=$(stat -f%Su /dev/console | awk '!/root/')

Make sure it's not empty then use something like.

/Users/$Current_User/Library/Keychains/login.keychain

In your script to reference the keychain.

Hi look

Thanks you for your reply, i have test your script but same error

Script result: SecCertificateAddToKeychain: The specified keychain could not be found.

My script :

!/bin/bash

Cuurent_User=$(stat -f%Su /dev/console | awk '!/root/')

sudo security add-trusted-cert -d -r unspecified -k /Users/$Current_User/Library/Keychains/login.keychain "/path/etc/certificat CA1.cer"

sudo security add-trusted-cert -d -r unspecified -k /Library/Keychains/System.keychain "/path/etc/certificat CA1.cer"

This script work just for install certificat on the keychain system but no work for the keychain User.

Cordially

Malik

@OUDJAMAA why scripting this & not via config profiles?