title: How to specify policy constraint for certificates using OS X's "security add-trusted-cert" command? (for SSL web socket connection)
body: <p>I'm building an application that will connect to the user's web browser through a secure web socket (SSL). I'm using <a href="http://websocketd.com" rel="nofollow noreferrer">Websocketd</a> to connect to the web socket, but that shouldn't matter. </p>
  
  <p><strong>Short version:</strong> </p>
  
  <p>I really just need help using the <code>add-trusted-cert</code> command... and Apple's man pages really don't help at all if you haven't used this before. How can I add a certificate to the System Keychain and only set the SSL and Basic option to "Aways Trust"? </p>
  
  <p><strong>Long version:</strong></p>
  
  <p>I am generating self-signed certificates and passing them into Websocketd in order to connect to the web socket over SSL. No further steps are required for Firefox and Chrome... they just work with this. Safari however, doesn't trust my self-signed certificates, and I have to go into Keychain Access and add my certificate and change the Trust settings to "Use Custom Settings" with <strong>ONLY</strong> the <em>SSL</em> option and the <em>X.509 Basic Policy</em> option set to "Always Trust"... any other settings and Safari complains. I don't want my users to have to fiddle with certificates, so my solution was to add my certificate to the System Keychain using a post-install script. Like so: </p>
  
  <pre><code>sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.Keychain" "./certificate.cert"
  </code></pre>
  
  <p>This successfully adds the certificate to the user's System Keychain... but it sets <em>all</em> of the options to "Always Trust"... for some reason Safari doesn't like this and complains. <strong>Only</strong> when the SSL and X.509 Basic Policy options are set to Always Trust and the rest set to "No Value Specified" does Safari behave. </p>
  
  <p>Okay so I checked out the <a href="https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man1/security.1.html" rel="nofollow noreferrer">man pages</a> for the "security add-trusted-cert" and sure enough there is an option that you can pass in to only set certain options to "Always Trust"... so I came up with this: </p>
  
  <pre><code>sudo security add-trusted-cert -d -r trustRoot -p ssl -k "/Library/Keychains/System.Keychain" "./certificate.cert"
  </code></pre>
  
  <p>The result of the <code>-p ssl</code> option is that now my certificate gets added to the System Keychain with only the SSL option set to Always Trust... but the basic option isn't! If I replace ssl with basic I can set the basic option to Always Trust: </p>
  
  <pre><code>sudo security add-trusted-cert -d -r trustRoot -p basic -k "/Library/Keychains/System.Keychain" "./certificate.cert"
  </code></pre>
  
  <p>But this still doesn't solve my issue! I need <strong>BOTH</strong> set to Always Trust, and the <em>other options left at "No Specified Value"</em>... so I tried this: </p>
  
  <pre><code>sudo security add-trusted-cert -d -r trustRoot -p ssl &amp; basic -k "/Library/Keychains/System.Keychain" "./certificate.cert"
  </code></pre>
  
  <p>But this doesn't work. I swear I've read all of Google on this subject and I can't find a single example of how to construct this command so that it accomplishes what I am describing. This <a href="https://curl.haxx.se/mail/archive-2013-10/0036.html" rel="nofollow noreferrer">link</a> confirmed what I need to do but didn't actually provide an example command, and this <a href="https://jamfnation.jamfsoftware.com/discussion.html?id=19116" rel="nofollow noreferrer">link</a> is searching the same answer I am... but nobody has replied with a suitable answer yet, and the accepted answer on <a href="https://stackoverflow.com/questions/20457071/ssl-certificates-os-x-mavericks">this</a> stackoverflow question is correct... but they just tell you what you need to do (I already know that), and don't tell you how to actually do it. </p>
  
  <p>So again, how can I add a certificate to the System Keychain and only set the SSL and Basic option to "Aways Trust"? </p>
  
  <p>Thank you!</p>