Adding Certs

You can send them out using Configuration Profiles.

We haven't started using these yet and I think it would be a lot of work and testing to first create and use these. Is there another way?

Yes, you can package up the .cer files in a .dmg using Composer, send them to the machine and then install them using a script.
I didn't write this particular script and we haven't used it for a while so this might be a bit out of date.
It was intended for the .cer files to be placed in /Library/Scripts/Certs and just looking at the for loop I am guessing it will fail if there are spaces in the filenames.

#!/bin/sh
for file in $(ls /Library/Scripts/Certs)
do
Echo "Adding $file"
if [[ $file == "YOUR_ROOT.cer" ]]; then
security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "/Library/Scripts/Certs/$file"
else
security add-trusted-cert -d -r trustAsRoot -k "/Library/Keychains/System.keychain" "/Library/Scripts/Certs/$file"
fi
done

Configuration Profiles = easy to manage

All I had to do was upload our cert in the Configuration Profiles.... It worked 1st try...