Question

How to set a self signed certificate to always trust.

Forum|Forum|5 years ago
September 3, 2020
29 replies
640 views

+3

baric-dondarion
New Contributor

Hello, we where able to deploy a self signed certificate via JAMF configuration profile using the certificate manager.

Unfortunately the certificate is not set to trust. I can set it to trust via command line but I would need to find a way to deploy the certificate file to the macbook laptop then run a trust command via script. Unfortunately there seem to be no documented way to do this.

How can I achieve my goal. How can I deploy a self signed certificate and tell all our jamf computers to always trust that certificate.

Show first post

1
2

Forum|pagination.label 2 / 2

G

+2

Go_Yes
New Contributor
Forum|Forum|3 years ago
October 28, 2022

haha I appreciate looking out. I definitely tested on several macs. A few straight out of the box, worked flawlessly. I think it helped that I exported the cert from keychain of local managed account.

Ok.. weird because I have done this trick, it has worked on my Mac, on which I got the trusted certificate, but not on other Mac. Still hoping to find a way.

Like

G

+2

Go_Yes
New Contributor
Forum|Forum|3 years ago
October 28, 2022

So I was running in to the same issue. The script would import the cert but it would not trust it. After a couple days on and off working on this. I finally realized that I was using the wrong -r command. I was using trustRoot as suggested above. But the cert I was using was not issued by another cert. So I had to change the –r command to trustAsRoot. example below. Hopefully this helps some of you.

Security add-trusted-cert -d -r trustAsRoot -k /Library/keychains/system.keychain

Great it worked for you. I guess it depends on the certificate chain we need to deploy..

Like

M

+3

MathiasO
New Contributor
Forum|Forum|3 years ago
November 8, 2022

Hi all!

I guess there is no further information from Apple for this "Issue"?
Devices with Monteray or Ventura won't fix the prompt upcoming, CPU Architecture also doesn't matter...
It is painful with our 5-6 Certs trusting manually.

Hope there will be an enterprise-friendly solution as soon as possible.

Greetings!