@Eigger Below are snippet samples of the shell script I wrote to handle this. I copied the cert files and the trust setting file locally on the machine in a temp directory and then let the script handle the installation of the certs as well as the import of the trust settings. One thing to keep in mind is that you'll need to create a trust settings file based on what you have set. This WILL export all trust settings so it's best you create the trust setting file on a machine that has mainly (or just) the certs you want to deploy.
Terminal command to export trust settings (do this after you have manually set your cert trust settings on your test machine):
/usr/bin/security trust-settings-export -d /Path/To/Save/File/trust_settings.plist
Terminal commands to install certs and apply trust settings (this is to be performed on your deployment machine):
Files needed in temp location: certificate file and trust settings plist file you created above.
Install cert to System Keychain:
/usr/bin/security add-certificates -k /Library/Keychains/System.keychain /temp/location/"AddTrust External CA Root.cer"
Apply cert trust settings:
/usr/bin/security trust-settings-import -d /temp/location/eduroam_trust_settings.plist
Hopefully this makes sense. Basically you're copying your cert files and trust setting plist to the machine locally. You then run these lines above to install the cert and import trust settings. You can add something into your script to delete these temp files afterwards. If you need more details, please don't hesitate to ask.
