title: Adding self-signed certificate as trusted in macOS doesn't work properly
body: <p>I'm trying to create a simple Makefile command in order to install self-signed certificate for local development of an Angular app.</p>
  
  <p>When I do this manually (by double-clicking on the certificate file, then opening a detail of it and setting everything to <code>Always Trust</code>) it works perfectly. On the other hand, the following command should do the same without any manual action, and as a matter of fact, it does (at least I couldn't find any difference in certificate details).</p>
  
  <pre class="lang-sh prettyprint-override"><code>security add-trusted-cert -d -r trustRoot -k "/Users/${USER}/Library/Keychains/login.keychain" certificates/local.angular.domain.crt
  </code></pre>
  
  <p>I also tried it with a sudo command (the only difference when using sudo is that it doesn't open the native popup for password, which I prefer as the user can authenticate using a fingerprint). </p>
  
  <p>Here's my whole Makefile command</p>
  
  <pre class="lang-sh prettyprint-override"><code>install-certificate:
      # generate certificate
      git clone https://github.com/RubenVermeulen/generate-trusted-ssl-certificate.git
      cd generate-trusted-ssl-certificate &amp;&amp; \
          sed -i.backup 's/CN.*/CN = local\.angular\.domain/g' ./openssl-custom.cnf &amp;&amp; \
          sed -i.backup 's/DNS\.1.*/DNS\.1 = \*\.local\.angular\.domain/g' ./openssl-custom.cnf &amp;&amp; \
          sed -i.backup 's/DNS\.2.*/DNS\.2 = local\.angular\.domain/g' ./openssl-custom.cnf &amp;&amp; \
          bash generate.sh
      mkdir -p certificates
      mv generate-trusted-ssl-certificate/server.key certificates/local.angular.domain.key
      mv generate-trusted-ssl-certificate/server.crt certificates/local.angular.domain.crt
      rm -rf generate-trusted-ssl-certificate
  
      # add certificate as trusted
      security add-trusted-cert -d -r trustRoot -k "/Users/${USER}/Library/Keychains/login.keychain" certificates/local.angular.domain.crt
      grep -qxF '127.0.0.1 local.angular.domain' /etc/hosts || sudo -- sh -c "echo '127.0.0.1 local.angular.domain' &gt;&gt; /etc/hosts"
  
      # clear DNS cache
      sudo dscacheutil -flushcache
      sudo killall -HUP mDNSResponder
  </code></pre>
  
  <p>This should be relatively easy to replicate as it generates the certificate itself and cleans up afterwards. Might be worth mentioning that the angular app runs on port 4200 (<code>https://local.angular.domain:4200</code>) which works smoothly when certificate is added manually. When added by the above command it shows the <code>NET::ERR_CERT_AUTHORITY_INVALID</code>. When I opened both certificates' details in chrome - they are the same. Thank you for any advice.</p>