CERTCTL(8)

NAME
certctl - tool for managing trusted and untrusted TLS certificates

SYNOPSIS
certctl [-lv] list
certctl [-lv] untrusted
certctl [-BnUv] [-D destdir] [-M metalog] rehash
certctl [-nv] untrust file ...
certctl [-nv] trust file ...

DESCRIPTION
The certctl utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL.

The following options are available:

-B  Do not generate a bundle. This option is only valid in conjunction with the rehash command.

-D destdir
    Specify the DESTDIR (overriding values from the environment).

-d distbase
    Specify the DISTBASE (overriding values from the environment).

-l  When listing installed (trusted or untrusted) certificates, show the full path and distinguished name for each certificate.

-M metalog
    Specify the path of the METALOG file ( default: ${DESTDIR}/METALOG). This option is only valid in conjunction with the rehash command.

-n  Dry-run mode. Do not actually perform any actions except write the metalog.

-v  Verbose mode. Print detailed information about each action taken.

-U  Unprivileged mode. Do not attempt to set the ownership of created files. This option is only valid in conjunction with the -M option and the rehash command.

Primary command functions:

list
    List all currently trusted certificates.

untrusted
    List all currently untrusted certificates.

rehash
    Rebuild the list of trusted certificates by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. A copy of each trusted certificate is placed in TRUSTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR. In addition, a bundle containing the trusted certificates is placed in BUNDLE.

untrust
    Add the specified file to the untrusted list. Note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in UNTRUSTPATH.

trust
    Add the specified file to the trusted list, unless it is already untrusted. Note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in TRUSTPATH.

ENVIRONMENT

DESTDIR
    Absolute path to an alternate destination directory to operate on instead of the file system root, e.g. “/tmp/install”.

DISTBASE
    Additional path component to include when operating on certificate directories. This must start with a slash, e.g. “/base”.

LOCALBASE
    Location for local programs. Defaults to the value of the user.localbase sysctl which is usually /usr/local.

TRUSTPATH
    List of paths to search for trusted certificates. Default: ${DESTDIR}${DISTBASE}/usr/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs

UNTRUSTPATH
    List of paths to search for untrusted certificates. Default: ${DESTDIR}${DISTBASE}/usr/share/certs/untrusted ${DESTDIR}${LOCALBASE}/share/certs/untrusted

TRUSTDESTDIR
    Destination directory for symbolic links to trusted certificates. Default: ${DESTDIR}${DISTBASE}/etc/ssl/certs

UNTRUSTDESTDIR
    Destination directory for symbolic links to untrusted certificates. Default: ${DESTDIR}${DISTBASE}/etc/ssl/untrusted

BUNDLE
    File name of bundle to produce. Default: ${DESTDIR}${DISTBASE}/etc/ssl/cert.pem

SEE ALSO
openssl(1)

HISTORY
certctl first appeared in FreeBSD 12.2.

AUTHORS
-nosplit The original shell implementation was written by Allan Jude <allanjude@FreeBSD.org>. The current C implementation was written by Dag-Erling Smørgrav <des@FreeBSD.org>.