Audit Custom Certificate Trust Settings with security dump-trust-settings

Reveal every root certificate whose trust has been manually overridden on the Mac.

macOScertificatetrustsecurityMedium risk

Run `security dump-trust-settings -d` for system-level overrides (sudo) and `security dump-trust-settings` for user-level ones.

01Command

Command

$ security dump-trust-settings -d
# User-level trust overrides:
security dump-trust-settings

02What it does

Trust settings live in a separate database from the keychain: a root certificate can be installed but only actively trusted if an entry exists here. `dump-trust-settings` prints each certificate name plus its per-purpose trust flags (SSL, S/MIME, code signing), including distrusted ('deny') entries that cause mysterious TLS failures. Reviewing both the admin domain (`-d`) and user domain is a standard step in security audits, because a silently trusted root CA enables full traffic interception.

03Risk

RiskMedium risk

!Warning: An empty output means no overrides exist — but some installers add trust via the GUI, which does create entries here.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

security — macOS Command Reference
SS64 · technical · 2026-09-17
Evidence: Documents dump-trust-settings and the -d (admin/system domain) flag.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil

macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17