mac电脑安装cmca根证书

在 macOS 上安装根证书并加入"受信任的根证书颁发机构"，核心是将证书导入"系统（System）"钥匙串，并将信任策略设为"始终信任"。

1.通过终端命令操作

打开"终端"，执行以下 security命令（需替换证书实际路径）：

复制代码

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/your_cert.crt

sudo：获取管理员权限；
-d：将证书添加到系统管理员首选位置；
-r trustRoot：将其标记为受信任的根证书；
-k：指定写入"系统钥匙串"。

完成后，该根证书即会对全机所有用户和大部分应用（如 Safari、Chrome、系统网络服务）生效。

2.验证是否成功

复制代码

security dump-keychain /Library/Keychains/System.keychain | grep -A5 "你的CA名称"

3.实操步骤

bash 复制代码

#查看需要安装的根证书
#ls
CMCA Internal Root CA_2048.cer		CMCA Internal Server CA_2048.cer


1.先安装root根证书，输入密码或者指纹
% sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./CMCA\ Internal\ Root\ CA_2048.cer
Password:

2.再安装Server证书，输入密码或者指纹
% sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ./CMCA\ Internal\ Server\ CA_2048.cer


3.验证是否安装成功
% security dump-keychain /Library/Keychains/System.keychain | grep -A5 "CMCA"
    "alis"<blob>="CMCA Internal  Server CA_2048"
    "cenc"<uint32>=0x00000003 
    "ctyp"<uint32>=0x00000001 
    "hpky"<blob>=0x6685884E1895BBD6CEE1FAADBF97BF746931657A  "f\205\210N\030\225\273\326\316\341\372\255\277\227\277ti1ez"
    "issu"<blob>=0x3049310B300906035504061302434E31153013060355040A0C0C4368696E61204D6F62696C653123302106035504030C1A434D434120496E7465726E616C20526F6F742043415F32303438  "0I1\0130\011\006\003U\004\006\023\002CN1\0250\023\006\003U\004\012\014\014China Mobile1#0!\006\003U\004\003\014\032CMCA Internal Root CA_2048"
    "labl"<blob>="CMCA Internal  Server CA_2048"
    "skid"<blob>=0x6685884E1895BBD6CEE1FAADBF97BF746931657A  "f\205\210N\030\225\273\326\316\341\372\255\277\227\277ti1ez"
    "snbr"<blob>=0x0423  "\004#"
    "subj"<blob>=0x3035310B300906035504061302434E3126302406035504030C1D434D434120496E7465726E616C20205365727665722043415F32303438  "051\0130\011\006\003U\004\006\023\002CN1&0$\006\003U\004\003\014\035CMCA Internal  Server CA_2048"
keychain: "/Library/Keychains/System.keychain"
version: 256
class: 0x80001000 
attributes:
    "alis"<blob>="CMCA Internal Root CA_2048"
    "cenc"<uint32>=0x00000003 
    "ctyp"<uint32>=0x00000001 
    "hpky"<blob>=0x49C13DF9E906A89030DFDEFDC117070F46D4234D  "I\301=\371\351\006\250\2200\337\336\375\301\027\007\017F\324#M"
    "issu"<blob>=0x3049310B300906035504061302434E31153013060355040A0C0C4368696E61204D6F62696C653123302106035504030C1A434D434120496E7465726E616C20526F6F742043415F32303438  "0I1\0130\011\006\003U\004\006\023\002CN1\0250\023\006\003U\004\012\014\014China Mobile1#0!\006\003U\004\003\014\032CMCA Internal Root CA_2048"
    "labl"<blob>="CMCA Internal Root CA_2048"
    "skid"<blob>=0x49C13DF9E906A89030DFDEFDC117070F46D4234D  "I\301=\371\351\006\250\2200\337\336\375\301\027\007\017F\324#M"
    "snbr"<blob>=0x041F 
    "subj"<blob>=0x3049310B300906035504061302434E31153013060355040A0C0C4368696E61204D6F62696C653123302106035504030C1A434D434120496E7465726E616C20526F6F742043415F32303438  "0I1\0130\011\006\003U\004\006\023\002CN1\0250\023\006\003U\004\012\014\014China Mobile1#0!\006\003U\004\003\014\032CMCA Internal Root CA_2048"

4.重启浏览器，再次访问不再提醒不安全