TRUST(1)

📦
version 0.26.5 · 15 versions
, in arch rolling, fedora 43, fedora 44

💖 NAME 💖

trust — the Tool for operating on the trust policy store ✨

(and just so we're clear, this is a User Commands page, section 1 of the manual, okay bestie? 🫶)

📜 SYNOPSIS 📜

trust list

trust extract --filter=<what> --format=<type> /path/to/destination

trust anchor /path/to/certificate.crt

trust dump

trust check-format /path/to/file.p11-kit...

🌸 DESCRIPTION 🌸

okay so trust is a command line tool that lets you examine and modify the shared trust policy store. main character energy fr 💅

scroll down for the various sub commands. but first, the global options that work everywhere:

  • -v, --verbose — Run in verbose mode with debug output. it's giving "tell me everything" 🔍
  • -q, --quiet — Run in quiet mode without warning or failure messages. shhh 🤫

🎀 LIST 🎀

List trust policy store items. slay.

$ trust list

Lists info about all the various items in the trust policy store. Every item gets listed with it's PKCS#11 URI plus some descriptive information. no cap 💖

you can pass these options to control what gets listed:

  • --filter=<what> — Specifies what certificates to extract. here's what you can put in:
    • ca-anchors — Certificate anchors
    • trust-policy — Anchors and blocklist (default)
    • blocklist — Distrusted certificates
    • certificates — All certificates
    • pkcs11:object=xx — A PKCS#11 URI to filter with
If an output format is chosen that cannot support the type what has been specified by the filter, a message will be printed. 😭
also, none of the available formats support storage of blocklist entries that do not contain a full certificate. so any certificates distrusted by their issuer and serial number alone are not included in the extracted blocklist. periodt 💀
  • --purpose=<usage> — Limit to certificates usable for the given purpose. pick one of these:
    • server-auth — For authenticating servers
    • client-auth — For authenticating clients
    • email — For email protection
    • code-signing — For authenticated signed code
    • 1.2.3.4.5... — An arbitrary purpose OID

⚓ ANCHOR ⚓

Store or remove trust anchors. iconic behaviour honestly 👑

$ trust anchor /path/to/certificate.crt
$ trust anchor --remove /path/to/certificate.crt
$ trust anchor --remove "pkcs11:id=%AA%BB%CC%DD%EE;type=cert"

Store or remove trust anchors in the trust policy store. these are usually root certificate authorities, bestie 🌳

specify either the --store or --remove operation. if you specify no operation at all, --store is assumed.

When storing, one or more certificate files are expected on the command line. they get stored as anchors, unless they are already present. (we don't do duplicates around here 💅)

When removing an anchor, either specify certificate files or PKCS#11 URI's on the command line. matching anchors will be removed.

It may be that this command needs to be run as root in order to modify the system trust policy store, if no user specific store is available. so like, if it's not working, that's probably why 🙈

you can specify the following options:

  • --remove — Remove one or more anchors from the trust policy store. Specify certificate files or PKCS#11 URI's on the command line.
  • --store — Store one or more anchors to the trust policy store. Specify certificate files on the command line.

📦 EXTRACT 📦

Extract trust policy from the shared trust policy store. let's get it out of there ✨

$ trust extract --format=x509-directory --filter=ca-anchors /path/to/directory

you can specify the following options to control what to extract. the --filter and --format arguments should be specified. and by default this command will not overwrite the destination file or directory. (protective, we love that 🫶)

  • --comment — Add identifying comments to PEM bundle output files before each certificate.
  • --filter=<what> — Specifies what certificates to extract. your options are:
    • ca-anchors — Certificate anchors (default)
    • trust-policy — Anchors and blocklist
    • blocklist — Distrusted certificates
    • certificates — All certificates
    • pkcs11:object=xx — A PKCS#11 URI
If an output format is chosen that cannot support the type what has been specified by the filter, a message will be printed. 😭
and again, none of the available formats support storage of blocklist entries that do not contain a full certificate. so any certificates distrusted by their issuer and serial number alone are not included in the extracted blocklist. iykyk 💀
  • --format=<type> — The format of the destination file or directory. pick one of these cuties:
    • x509-file — DER X.509 certificate file
    • x509-directory — directory of X.509 certificates
    • pem-bundle — File containing one or more certificate PEM blocks
    • pem-directory — Directory of PEM files each containing one certificate
    • pem-directory-hash — Directory of PEM files each containing one certificate, with hash symlinks
    • openssl-bundle — OpenSSL specific PEM bundle of certificates
    • openssl-directory — Directory of OpenSSL specific PEM files
    • java-cacerts — Java keystore 'cacerts' certificate bundle
  • --overwrite — Overwrite output file or directory. (go ahead, be bold 💅)
  • --purpose=<usage> — Limit to certificates usable for the given purpose. choose from:
    • server-auth — For authenticating servers
    • client-auth — For authenticating clients
    • email — For email protection
    • code-signing — For authenticated signed code
    • 1.2.3.4.5... — An arbitrary purpose OID

🌈 EXTRACT COMPAT 🌈

Extract compatibility trust certificate bundles. the "make it work with the old girlies" command 🧚

$ trust extract-compat

so here's the thing: OpenSSL, Java and some versions of GnuTLS cannot currently read trust information directly from the trust policy store. this command extracts trust information such as certificate anchors for use by these libraries. bestie behaviour, honestly 💜

What this command does, and where it extracts the files, is distribution or site specific. Packagers or administrators are expected to customize this command.

🔍 DUMP 🔍

Dump PKCS#11 items in the various tokens. spill the tea, tokens ☕

$ trust dump

Dumps information about the various PKCS#11 items in the tokens. every item gets dumped with it's PKCS#11 URI and information in the .p11-kit persistence format.

you can specify the following options to control what to dump:

  • --filter=<what> — Specifies what certificates to extract. your choices:
    • all — All objects. This is the default
    • pkcs11:object=xx — A PKCS#11 URI to filter with

✅ CHECK FORMAT ✅

Check the format of .p11-kit files. vibe check but for files 🎯

$ trust check-format /path/to/file.p11-kit...

Administrators sometimes need to write a custom .p11-kit file to amend the trust information. this is an error prone process, because the file format is mainly for machine processing. so administrators can use this command to check whether a file has a correct .p11-kit format. you're welcome 💖

This command takes an arbitrary number of files as an input. Each file is then analysed and any mismatch with the .p11-kit format is reported on the standard error output. After the file is processed a check result is printed on the standard output. two streams, two jobs, we stan a multitasker ✨

🐛 BUGS 🐛

Please send bug reports to either the distribution bug tracker or the upstream bug tracker at https://github.com/p11-glue/p11-kit/issues/. don't be shy, they wanna hear it 🙈

👀 SEE ALSO 👀

and that's the whole page, bestie!! this absolute icon of a manual page comes to you from p11-kit, and it's the TRUST(1) page. now go forth and trust responsibly 💅💖✨

📦 where this page comes from