FreeBSD manual

download PDF document: certctl.8.pdf

CERTCTL(8) FreeBSD System Manager's Manual CERTCTL(8) NAME certctl - tool for managing trusted and untrusted TLS certificates SYNOPSIS certctl [-v] list certctl [-v] untrusted certctl [-nUv] [-D destdir] [-M metalog] rehash certctl [-nv] untrust file certctl [-nv] trust file DESCRIPTION The certctl utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL. Flags: -D destdir Specify the DESTDIR (overriding values from the environment). -d distbase Specify the DISTBASE (overriding values from the environment). -M metalog Specify the path of the METALOG file (default: $DESTDIR/METALOG). -n No-Op mode, do not actually perform any actions. -v Be verbose, print details about actions before performing them. -U Unprivileged mode, do not change the ownership of created links. Do record the ownership in the METALOG file. Primary command functions: list List all currently trusted certificate authorities. untrusted List all currently untrusted certificates. rehash Rebuild the list of trusted certificate authorities by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. A symbolic link to each trusted certificate is placed in CERTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR. untrust Add the specified file to the untrusted list. trust Remove the specified file from the untrusted list. ENVIRONMENT DESTDIR Alternate destination directory to operate on. DISTBASE Additional path component to include when operating on certificate directories. TRUSTPATH List of paths to search for trusted certificates. Default: <DESTDIR><DISTBASE>/usr/share/certs/trusted <DESTDIR><DISTBASE>/usr/local/share/certs CERTDESTDIR Destination directory for symbolic links to trusted certificates. Default: <DESTDIR><DISTBASE>/etc/ssl/certs UNTRUSTDESTDIR Destination directory for symbolic links to untrusted certificates. Default: <DESTDIR><DISTBASE>/etc/ssl/untrusted EXTENSIONS List of file extensions to read as certificate files. Default: *.pem *.crt *.cer *.crl *.0 SEE ALSO openssl(1) HISTORY certctl first appeared in FreeBSD 12.2 AUTHORS Allan Jude <allanjude@freebsd.org> FreeBSD 14.2-RELEASE July 13, 2022 FreeBSD 14.2-RELEASE