3.3. Trusted system certificates management with the trust command

To see the built-in help for the trust command, enter it without any arguments or with the --help directive. Also, all subcommands of the trust commands provide a detailed built-in help, for example:

$ trust list --help
usage: trust list --filter=<what>
…

To list all system trust anchors and certificates, use the trust list command, for example:

$ trust list
…
pkcs11:id=%DD%04%09%07%A2%F5%7A%7D%52%53%12%92%95%EE%38%80%25%0D%A6%59;type=cert
    type: certificate
    label: SSL.com Root Certification Authority RSA
    trust: anchor
    category: authority
…

To store a trust anchor into the system-wide truststore, use the trust anchor subcommand and specify a path to a certificate. Replace <path.to/certificate.crt> by a path to your certificate and its file name:

# trust anchor <path.to/certificate.crt>

To remove a certificate, use either a path to a certificate or the ID of a certificate:

# trust anchor --remove <path.to/certificate.crt>
# trust anchor --remove "pkcs11:id=<%AA%BB%CC%DD%EE>;type=cert"