trust

Manage system trust policy certificate store

TLDR

List trust policy store items

$ trust list

List information about specific items in the trust policy store

$ trust list --filter=[blocklist|ca-anchors|certificates|trust-policy]

Store a trust anchor in the trust policy store

$ trust anchor [path/to/certificate.crt]

Remove an anchor from the trust policy store

$ trust anchor --remove [path/to/certificate.crt]

Extract trust policy to a directory

$ trust extract --format=x509-directory --filter=ca-anchors [path/to/directory]

Display help for a subcommand

$ trust [subcommand] --help

trust manages the shared system trust policy store, which contains trusted CA certificates, blocklisted certificates, and trust policies. It allows administrators to add, remove, and extract trust anchors used for TLS/SSL verification across the system.Changes made with trust affect all applications that use the p11-kit trust module, providing a unified way to manage certificates rather than configuring each application individually.

PARAMETERS

list

List trust policy store items

anchor file

Add a trust anchor to the store

anchor --remove file

Remove a trust anchor

extract --format=format path

Extract trust anchors in specified format.

extract-compat

Extract trust policy in a format compatible with the system's native tools.

--filter=type

Filter by type (ca-anchors, blocklist, certificates, trust-policy).

--format=format

Output format (x509-file, x509-directory, pem-file, pem-bundle, java-cacerts, openssl-bundle, openssl-directory, etc.).

--purpose=purpose

Filter by purpose (server-auth, client-auth, email, code-signing).

INSTALL

sudo apt install p11-kit

sudo dnf install p11-kit

sudo pacman -S p11-kit

sudo apk add p11-kit-trust

sudo zypper install p11-kit

brew install p11-kit

nix profile install nixpkgs#p11-kit

CAVEATS

May require root privileges to modify the system trust store if no user-specific store is available. Changes may require applications to be restarted to take effect. The store format and location varies by distribution.

HISTORY

Part of p11-kit, developed as part of the FreeDesktop.org project to provide a standard way to manage trust anchors across Linux distributions. Replaces distribution-specific methods like update-ca-certificates.