certctl8

Usage

Overview

The certctl utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL.

The following options are available:

-B

Do not generate a bundle. This option is only valid in conjunction with the rehash command.

-D destdir

Specify the DESTDIR (overriding values from the environment).

-d distbase

Specify the DISTBASE (overriding values from the environment).

-l

When listing installed (trusted or untrusted) certificates, show the full path and distinguished name for each certificate.

-M metalog

Specify the path of the METALOG file( default: ${DESTDIR}/METALOG). This option is only valid in conjunction with the rehash command.

-n

Dry-run mode. Do not actually perform any actions except write the metalog.

-v

Verbose mode. Print detailed information about each action taken.

-U

Unprivileged mode. Do not attempt to set the ownership of created files. This option is only valid in conjunction with the -M option and the rehash command.

Primary command functions:

list

List all currently trusted certificates.

untrusted

List all currently untrusted certificates.

rehash

Rebuild the list of trusted certificates by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. A copy of each trusted certificate is placed in TRUSTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR. In addition, a bundle containing the trusted certificates is placed in BUNDLE.

untrust

Add the specified file to the untrusted list. Note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in UNTRUSTPATH.

trust

Add the specified file to the trusted list, unless it is already untrusted. Note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in TRUSTPATH.

Environment

DESTDIR

Absolute path to an alternate destination directory to operate on instead of the file system root, e.g. “/tmp/install”.

DISTBASE

Additional path component to include when operating on certificate directories. This must start with a slash, e.g. “/base”.

LOCALBASE

Location for local programs. Defaults to the value of the user.localbase sysctl which is usually /usr/local.

TRUSTPATH

List of paths to search for trusted certificates. Default: ${DESTDIR}${DISTBASE}/usr/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs

UNTRUSTPATH

List of paths to search for untrusted certificates. Default: ${DESTDIR}${DISTBASE}/usr/share/certs/untrusted ${DESTDIR}${LOCALBASE}/share/certs/untrusted

TRUSTDESTDIR

Destination directory for symbolic links to trusted certificates. Default: ${DESTDIR}${DISTBASE}/etc/ssl/certs

UNTRUSTDESTDIR

Destination directory for symbolic links to untrusted certificates. Default: ${DESTDIR}${DISTBASE}/etc/ssl/untrusted

BUNDLE

File name of bundle to produce. Default: ${DESTDIR}${DISTBASE}/etc/ssl/cert.pem