CERTCTL(8)

🎀 CERTCTL(8) 🎀

okay bestie, welcome to certctl — the System Manager's Manual page that's about to become your new hyperfixation. it's a tool for managing trusted and untrusted TLS certificates, and yes, it's giving main character energy in the OpenSSL universe. 💅

---

✨ NAME ✨

certctl — tool for managing trusted and untrusted TLS certificates

---

🦋 SYNOPSIS 🦋

certctl [-lv] list
certctl [-lv] untrusted
certctl [-BnUv] [-D destdir] [-M metalog] rehash
certctl [-nv] untrust file ...
certctl [-nv] trust file ...

---

💖 DESCRIPTION 💖

so like, the certctl utility manages the list of TLS Certificate Authorities that are trusted by applications that use OpenSSL. that's the whole vibe. it curates the guest list for your TLS party and it does not let randoms in. 🚪✨

The following options are available:

• -B — do not generate a bundle. lowkey this one is only valid in conjunction with the rehash command, so don't try it anywhere else, bestie.
• -D destdir — specify the DESTDIR (overriding values from the environment).
• -d distbase — specify the DISTBASE (overriding values from the environment).
• -l — when listing installed (trusted or untrusted) certificates, show the full path and distinguished name for each certificate. the way that it gives you all the details. 🔍
• -M metalog — specify the path of the METALOG file (default: ${DESTDIR}/METALOG). this option is only valid in conjunction with the rehash command.
• -n — dry-run mode. do not actually perform any actions except write the metalog. it's the "let's just see what would happen" era. 🙈
• -v — verbose mode. print detailed information about each action taken. she's chatty and we love that for her. 💬
• -U — unprivileged mode. do not attempt to set the ownership of created files. this option is only valid in conjunction with the -M option and the rehash command.

👑 Primary command functions 👑

• list — list all currently trusted certificates. the VIP list, basically.
• untrusted — list all currently untrusted certificates. the blocked list. and honestly? iconic of them to keep track. 💀
• rehash — rebuild the list of trusted certificates by scanning all directories in TRUSTPATH and all untrusted certificates in UNTRUSTPATH. a copy of each trusted certificate is placed in TRUSTDESTDIR and each untrusted certificate in UNTRUSTDESTDIR. in addition, a bundle containing the trusted certificates is placed in BUNDLE. this is the whole glow-up routine where everything gets sorted. 🧚
• untrust — add the specified file to the untrusted list. note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in UNTRUSTPATH. so like, it's not permanent unless you commit to it, bestie. ⚠️
• trust — add the specified file to the trusted list, unless it is already untrusted. note that the next rehash will remove it unless a copy of it is also placed somewhere in a directory included in TRUSTPATH. same deal — the rehash is the vibe check that decides who stays. 🫶

---

🌈 ENVIRONMENT 🌈

• DESTDIR — absolute path to an alternate destination directory to operate on instead of the file system root, e.g. “/tmp/install”.
• DISTBASE — additional path component to include when operating on certificate directories. this must start with a slash, e.g. “/base”. yes, the slash is mandatory, don't come for me. 🌸
• LOCALBASE — location for local programs. defaults to the value of the user.localbase sysctl which is usually /usr/local.
• TRUSTPATH — list of paths to search for trusted certificates. default: ${DESTDIR}${DISTBASE}/usr/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs/trusted ${DESTDIR}${LOCALBASE}/share/certs
• UNTRUSTPATH — list of paths to search for untrusted certificates. default: ${DESTDIR}${DISTBASE}/usr/share/certs/untrusted ${DESTDIR}${LOCALBASE}/share/certs/untrusted
• TRUSTDESTDIR — destination directory for symbolic links to trusted certificates. default: ${DESTDIR}${DISTBASE}/etc/ssl/certs
• UNTRUSTDESTDIR — destination directory for symbolic links to untrusted certificates. default: ${DESTDIR}${DISTBASE}/etc/ssl/untrusted
• BUNDLE — file name of bundle to produce. default: ${DESTDIR}${DISTBASE}/etc/ssl/cert.pem

---

🔥 SEE ALSO 🔥

openssl(1) — go give her a read too, she's the blueprint. 💜

---

⭐ HISTORY ⭐

certctl first appeared in FreeBSD 12.2. a true era. ✨

---

🌸 AUTHORS 🌸

the original shell implementation was written by Allan Jude <allanjude@FreeBSD.org>. the current C implementation was written by Dag-Erling Smørgrav <des@FreeBSD.org>. legends, both of them, no cap. 👑

---

okay that's the whole page, bestie! and for the cute sign-off: this glorious little page lives under the Debian banner, dated April 24, 2026, and it's officially CERTCTL(8) — drink water, rehash your trust store, and stay unproblematic 🍓💖