Checking Certificates Meet Apple Requirements
So it turns out there is an OS level tool, security

For example, I can test if a certificate ca.crt is valid like this:

security verify-cert -c ca.crt


Here's what a valid certificate will look like:

❯ security verify-cert -c ca.crt
...certificate verification successful.


And here's a certificate with a 10 year expiration that violates Apples rules, but is otherwise valid according to OpenSSH:

❯ security verify-cert -c ca.crt
Cert Verify Result: CSSMERR_TP_NOT_TRUSTED