# Script to distribute certificate on macOS devices

Security certificates installed on the devices enable access to websites and other resources. Importing the certificates with the Terminal commands is an easy method to deploy certificates obtained from a Trusted Certificate Authority (CA). With Hexnode, you can remotely add the certificates hosted on your organization network to the macOS devices using the [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) action.

 Disclaimer:The Sample Scripts provided below are adapted from third-party Open-Source sites.

 

Add certificate to the System Keychain 
---------------------------------------

Sample script to add certificate to the System Keychain

curl –O Provide the URL and the certificate\_name to download the certificate here sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /Users/certificate\_name /usr/bin/security authorizationdb write system.preferences <<EndOfPlist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>allow-root</key> <true/> <key>authenticate-user</key> <true/> <key>class</key> <string>user</string> <key>comment</key> <string>Checked by the Admin framework when making changes to certain System Preferences.</string> <key>group</key> <string>techs</string> <key>session-owner</key> <false/> <key>shared</key> <true/> </dict> </plist> EndOfPlist 

   1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

  curl –O Provide the URL and the certificate\_name to download the certificate here 

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /Users/certificate\_name

/usr/bin/security authorizationdb write system.preferences <<EndOfPlist

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

<key>allow-root</key>

<true/>

<key>authenticate-user</key>

<true/>

<key>class</key>

<string>user</string>

<key>comment</key>

<string>Checked by the Admin framework when making changes to certain System Preferences.</string>

<key>group</key>

<string>techs</string>

<key>session-owner</key>

<false/>

<key>shared</key>

<true/>

</dict>

</plist>

EndOfPlist 

   

 

  

 Notes:- After the download, the user must change the certificate trust policy from the *Keychain Access* to establish trust and determine if the certificate is valid for specific uses.
- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.