Mac Forum / Applications / Mac Applications / September 2005

Safari's certificates are kept in a system keychain file.  It's in the
file /System/Library/Keychains/X509Anchors

In order to view it, at least one way, there might be others, is to open
your "KeyChain Access.app" in the Utilities folder and use the "Add
KeyChain" menu item under the File menu.  This will allow you to browse
the file.

AFAICT you can't use KeyChain Access to modify this file, or even a copy
of it.  The only way I know of to add a CA certificate to the
X509Anchors file is with the "certtool" command in the Terminal.

I've forgotten where I saw this posted but if you need to add a CA
certificate to the system keychain here's how:

-------------Apologies to the original author-----------------
You need to copy the master keychain used by Safari to your own
~/Library/Keychains folder before using  certtool, then copy it back
again (using sudo).

So:
% cp /System/Library/Keychains/X509Anchors ~/Library/Keychains

% certtool i mycert.pem k=X509Anchors

% sudo cp ~/Library/Keychains/X509Anchors
/System/Library/Keychains/X509Anchors

---------------------------------------------------------------

(The last one is all on one line.)

"mycert.pem" is, of course, your CA certificate that you want to add to
Safari, substitute that with the real name of your certificate.