---
name: "certctl"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/certctl"
---

# certctl(8)

tool for managing trusted and untrusted TLS certificates

## NAME

**certctl** – tool for managing trusted and untrusted TLS certificates

## SYNOPSIS

**certctl** \[**-lv**\] **list**

**certctl** \[**-lv**\] **untrusted**

**certctl** \[**-BnUv**\] \[**-D** *destdir*\] \[**-M** *metalog*\] **rehash**

**certctl** \[**-nv**\] **untrust** *file ...*

**certctl** \[**-nv**\] **trust** *file ...*

## DESCRIPTION

The **certctl** utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL.

The following options are available:

- **-B**

  Do not generate a bundle. This option is only valid in conjunction with the **rehash** command.

- **-D** *destdir*

  Specify the DESTDIR (overriding values from the environment).

- **-d** *distbase*

  Specify the DISTBASE (overriding values from the environment).

- **-l**

  When listing installed (trusted or untrusted) certificates, show the full path and distinguished name for each certificate.

- **-M** *metalog*

  Specify the path of the METALOG file( default: *${DESTDIR}/METALOG*). This option is only valid in conjunction with the **rehash** command.

- **-n**

  Dry-run mode. Do not actually perform any actions except write the metalog.

- **-v**

  Verbose mode. Print detailed information about each action taken.

- **-U**

  Unprivileged mode. Do not attempt to set the ownership of created files. This option is only valid in conjunction with the **-M** option and the **rehash** command.

Primary command functions:

- **list**

  List all currently trusted certificates.

- **untrusted**

  List all currently untrusted certificates.

- **rehash**

  Rebuild the list of trusted certificates by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. A copy of each trusted certificate is placed in TRUSTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR. In addition, a bundle containing the trusted certificates is placed in BUNDLE.

- **untrust**

  Add the specified file to the untrusted list. Note that the next **rehash** will remove it unless a copy of it is also placed somewhere in a directory included in UNTRUSTPATH.

- **trust**

  Add the specified file to the trusted list, unless it is already untrusted. Note that the next **rehash** will remove it unless a copy of it is also placed somewhere in a directory included in TRUSTPATH.

## ENVIRONMENT

- DESTDIR

  Absolute path to an alternate destination directory to operate on instead of the file system root, e.g. “/tmp/install”.

- DISTBASE

  Additional path component to include when operating on certificate directories. This must start with a slash, e.g. “/base”.

- LOCALBASE

  Location for local programs. Defaults to the value of the user.localbase sysctl which is usually */usr/local*.

- TRUSTPATH

  List of paths to search for trusted certificates. Default: *${DESTDIR}${DISTBASE}/usr/share/certs/trusted* *${DESTDIR}${LOCALBASE}/share/certs/trusted* *${DESTDIR}${LOCALBASE}/share/certs*

- UNTRUSTPATH

  List of paths to search for untrusted certificates. Default: *${DESTDIR}${DISTBASE}/usr/share/certs/untrusted* *${DESTDIR}${LOCALBASE}/share/certs/untrusted*

- TRUSTDESTDIR

  Destination directory for symbolic links to trusted certificates. Default: *${DESTDIR}${DISTBASE}/etc/ssl/certs*

- UNTRUSTDESTDIR

  Destination directory for symbolic links to untrusted certificates. Default: *${DESTDIR}${DISTBASE}/etc/ssl/untrusted*

- BUNDLE

  File name of bundle to produce. Default: *${DESTDIR}${DISTBASE}/etc/ssl/cert.pem*

## SEE ALSO

[openssl(1)](/openssl/1.md)

## HISTORY

**certctl** first appeared in FreeBSD 12.2.

## AUTHORS

The original shell implementation was written by Allan Jude ⟨*allanjude@FreeBSD.org*⟩. The current C implementation was written by Dag-Erling Smørgrav ⟨*des@FreeBSD.org*⟩.