Adding a Custom Certificate Authority (CA)?

I’ve mentioned this command before for adding a Certificate Authority (CA) to Leopard:

/usr/bin/security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" /private/tmp/mycert.pem

and also mentioned that you could target a non-boot volume in a payload-free CustomPKG by putting $3 in front of the paths. I’ve learned today that installing the CA on a non-boot volume appears to not retain the trust settings when you start up from the targeted volume. I think it used to work before 10.5.3, but I can’t be sure.

Installing the CA on first startup of a freshly imaged machine appears to be the best way to go.

– Patrick