Manual Pages  — CERTCTL

certctl – tool for managing trusted and untrusted TLS certificates

SYNOPSIS DESCRIPTION ENVIRONMENT SEE ALSO HISTORY AUTHORS

certctl [-v] list
certctl [-v] untrusted
certctl [-nUv] [-D destdir] [-M metalog] rehash
certctl [-nv] untrust file
certctl [-nv] trust file

The certctl utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL.

Flags:

-D destdir
	Specify the DESTDIR (overriding values from the environment).
-d distbase
	Specify the DISTBASE (overriding values from the environment).
-M metalog
	Specify the path of the METALOG file (default: $DESTDIR/METALOG).
-n
	No-Op mode, do not actually perform any actions.
-v
	Be verbose, print details about actions before performing them.
-U
	Unprivileged mode, do not change the ownership of created links. Do record the ownership in the METALOG file.

Primary command functions:

list	List all currently trusted certificate authorities.
untrusted
	List all currently untrusted certificates.
rehash	Rebuild the list of trusted certificate authorities by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. A symbolic link to each trusted certificate is placed in CERTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR.
untrust	Add the specified file to the untrusted list.
trust	Remove the specified file from the untrusted list.

DESTDIR	Alternate destination directory to operate on.
DISTBASE	Additional path component to include when operating on certificate directories.
TRUSTPATH	List of paths to search for trusted certificates. Default: <DESTDIR><DISTBASE>/usr/share/certs/trusted <DESTDIR><DISTBASE>/usr/local/share/certs <DESTDIR><DISTBASE>/usr/local/etc/ssl/certs
UNTRUSTPATH	List of paths to search for untrusted certificates. Default: <DESTDIR><DISTBASE>/usr/share/certs/untrusted <DESTDIR><DISTBASE>/usr/local/etc/ssl/untrusted <DESTDIR><DISTBASE>/usr/local/etc/ssl/blacklisted
CERTDESTDIR	Destination directory for symbolic links to trusted certificates. Default: <DESTDIR><DISTBASE>/etc/ssl/certs
UNTRUSTDESTDIR
	Destination directory for symbolic links to untrusted certificates. Default: <DESTDIR><DISTBASE>/etc/ssl/untrusted
EXTENSIONS	List of file extensions to read as certificate files. Default: *.pem *.crt *.cer *.crl *.0

openssl(1)

certctl first appeared in FreeBSD 12.2

Allan Jude <Mt allanjude@freebsd.org>