Root Certificates?

[mgb123]

I have a 2 part question.

1) Is it possible to add a root certificate to my build?

2) Assuming that I’m never going to let the build out of my site – is it inadvisable to do so?

I’m about as certificate dumb as you can get – so I’m really unsure of best practices here.

[Tim Sutton]

It’s possible to easily script it as part of your firstboot. I copy a certificate to /usr/local/share as part of my general support package (which is common across all images), and somewhere in my common firstboot I have this:

/usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /usr/local/share/the_certificate.cer

I’m also fairly clueless about certificates, but this has been what’s worked for me. I suppose it would be possible to have a postflight script that would run this command with the keychain path prepended with $3 so that it will point to the target volume in the InstaDMG build. Never tried that however.

[mgb123]

This functions perfectly!

I have a pkg that puts the cert down, and then the 1st boot script installs it and deletes it from the temp location.

Perfect!

[Author]

Posts