Is there a list of valid system root certificate authorities for a vanilla OSX (Lion, Mountain Lion) installation?

Question

I'm looking for a current list of valid CAs to compare to those in system keychain.  thnxs!

Answer 1

You can dump all of the root certificates with:
security find-certificate -a -Z /System/Library/Keychains/SystemRootCertificates.keychain
Here's a script I wrote a while ago as part of an attempt to mitigate CAs that I didn't want to trust... I work in a government environment, so it seems silly to trust CAs from China and Russia, as well as an assortment of other oddball countries.  Maybe it will help you find what you're looking for:
#!/bin/sh
if [ -f /tmp/rootcerts ]
then
  rm -f /tmp/rootcerts
fi
if [ -f /tmp/rootcerts.sh ]
then
  rm -f /tmp/rootcerts.sh
fi
if [ -f /tmp/ccs ]
then
  rm -f /tmp/ccs
fi
echo ""
echo "Script generated at /tmp/rootcerts.sh"
echo ""
security find-certificate -a -Z /System/Library/Keychains/SystemRootCertificates.keychain | sed 's/^\ \ \ \ //' | grep -v '^keychain\|^class\|^attributes\|^"cenc\|^"ctyp\|^"hpky\|^"issu\|^"alis\|^"skid \|^"snbr\|^"subj'| sed 'N;s/\n/@/' | sed 's/"labl"\<blob\>\=//' | sed 's/^SHA-1\ hash\:\ //' | sort -t'@' -k2 > /tmp/rootcerts
while read line
do
  SHA=`echo $line | cut -d'@' -f1`
  NAME=`echo $line | cut -d'@' -f2`
  NAME2=`echo $line | cut -d'@' -f2 | sed -e 's/^\"//' -e 's/\"$//'`
  security find-certificate -c "$NAME2" /System/Library/Keychains/SystemRootCertificates.keychain >/dev/null 2>&1
  if [ "$?" -eq "0" ]
  then
    APPL=0
    security find-certificate -c "$NAME2" /System/Library/Keychains/SystemRootCertificates.keychain | grep [Aa]pple >/dev/null 2>&1
    if [ "$?" -eq "0" ]
    then
      APPL=1
    fi
    DOD=0
    security find-certificate -c "$NAME2" /System/Library/Keychains/SystemRootCertificates.keychain | grep DoD >/dev/null 2>&1
    if [ "$?" -eq "0" ]
    then
      DOD=1
    fi
    CTRY=`security find-certificate -c "$NAME2" -p /System/Library/Keychains/SystemRootCertificates.keychain | openssl x509 -text | grep '^\ *Issuer:' | tr -s ' ' | cut -d' ' -f3 | sed -e 's/^C=//' -e 's/,$//' | sed 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'`
    case $CTRY in
      [A-Z][A-Z] ) if [ "$APPL" -eq "1" ]
                   then
                     echo "# $NAME - APPLE" >> /tmp/rootcerts.sh
                     echo "#security delete-certificate -Z $SHA /System/Library/Keychains/SystemRootCertificates.keychain" >> /tmp/rootcerts.sh
                     echo "" >> /tmp/rootcerts.sh
                   elif [ "$DOD" -eq "1" ]
                   then
                     echo "# $NAME - DoD" >> /tmp/rootcerts.sh
                     echo "#security delete-certificate -Z $SHA /System/Library/Keychains/SystemRootCertificates.keychain" >> /tmp/rootcerts.sh
                     echo "" >> /tmp/rootcerts.sh
                   else
                     echo "# $NAME - $CTRY" >> /tmp/rootcerts.sh
                     echo "security delete-certificate -Z $SHA /System/Library/Keychains/SystemRootCertificates.keychain" >> /tmp/rootcerts.sh
                     echo "" >> /tmp/rootcerts.sh
                   fi ;;
      * ) echo "# $NAME did not return a valid country code" >> /tmp/rootcerts.sh
          echo "security delete-certificate -Z $SHA /System/Library/Keychains/SystemRootCertificates.keychain" >> /tmp/rootcerts.sh
          echo "" >> /tmp/rootcerts.sh ;;
    esac
  else
    echo "$NAME could not be read" >> /tmp/rootcerts.sh
    echo "" >> /tmp/rootcerts.sh
  fi
done</tmp/rootcerts
ALL1=`security find-certificate -a /System/Library/Keychains/SystemRootCertificates.keychain | grep labl | wc -l`
echo "There are $ALL1 certificates in SystemRootCertificates"
echo ""
ALL=`grep '^security' /tmp/rootcerts.sh | wc -l | sed 's/^\ *//' | grep -v '^$'`
echo "There were $ALL certificates read and dumped into rootcerts.sh"
echo ""
NOCODE=`grep '^#.*did not return a valid country code' /tmp/rootcerts.sh | wc -l | sed 's/^\ *//' | grep -v '^$'`
echo "There were $NOCODE certificates that did not return a country code"
echo ""
grep '^#.*\ \-\ ' /tmp/rootcerts.sh | sed 's/^#\ .*\ \-\ //g' | sort | uniq > /tmp/ccs
for i in `cat /tmp/ccs`
do
  NUM=`grep $i$ /tmp/rootcerts.sh | wc -l | sed 's/^\ *//' | grep -v '^$'`
  echo "There were $NUM entries in country code $i"
done
if [ -f /tmp/ccs ]
then
  rm -f /tmp/ccs
fi
if [ -f /tmp/rootcerts ]
then
  rm -f /tmp/rootcerts
fi