A SERVICE OF

logo

Open as PDF
next previous
Several keychains can hold certicates:
 SystemRootCerticates: This keychain holds root certicates that ship with
Mac OS X. The certicates already have trust given to them.
 System: This keychain holds certicates that the computer administrator can add. All
users on a given client can read from this keychain. The trust settings of a certicate
in this keychain can override those of a certicate in SystemRootCerticates.
 Any other keychain: This holds certicates for a given user and is only accessible to
that user. The trust settings of a certicate in this keychain can override those of a
certicate in SystemRootCerticates or System.
Trusted certicates can be in any of these locations, but to trust a certicate,
trust settings must be given explicitly to a certicate.
To congure clients to trust a certicate:
1 Copy the self-signed CA certicate (the le named ca.crt) onto each client computer.
This is preferably distributed using nonrewritable media, such as a CD-R. Using
nonrewritable media prevents the certicate from being corrupted.
2 Open the Keychain Access tool by double-clicking the ca.crt icon where the certicate
was copied onto the client computer.
3 Drag the certicate to the System keychain using Keychain Access.
Authenticate as an administrator, if requested.
4 Double-click the certicate to get the certicate details.
5 In the details window, click the Trust disclosure triangle.
6 From the pop-up menu next to “When using this certicate,” select “Always Trust”
You have now added trust to this certicate, regardless of who it is signed by.
From the command line
After copying the certicate to the target client computer, perform the following,
replacing <certicate> with the le path to the certicate:
sudo /usr/bin/security add-trusted-cert -d -k /Library/Keychains/System.
keychain <certificate>
You can use the security tool to save and restore trust settings as well. For more
information on using the security command-line tool, see the security man page.
Certicate Manager in Server Admin
Mac OS X Server’s Certicate Manager is integrated into Server Admin to help you
create, use, and maintain identities for SSL-enabled services.
62 Chapter 4 Enhancing Security