security: SecKeychainItemDelete: UNIX[Operation not permitted] on OS X when trying to remove a system root expired cert

Question

So I see some expired certs under 'System Roots' (not 'System'), so I want to delete them via cmd.

sudo security delete-certificate -c A-Trust-nQual-01 /System/Library/Keychains/SystemRootCertificates.keychain

However bash reports

security: SecKeychainItemDelete: UNIX[Operation not permitted]

I entered the correct password for sudo for sure. How can I proceed?

OS: latest MAC OS X release, not beta.

Update: I even tried with sudo su as root, still not work:

sh-3.2# security delete-certificate -c A-Trust-nQual-01 /System/Library/Keychains/SystemRootCertificates.keychain 
security: SecKeychainItemDelete: UNIX[Operation not permitted]
sh-3.2# whoami
root
sh-3.2#

score 2 · Accepted Answer · answered Apr 28 '16 at 19:53

2

It's just System Integrity Protection (SIP) that prevents even root from modifying the contents of /System — you can toggle it by booting to the Recovery Partition (reboot holding Command-R) and then running csrutil disable command in the Terminal (more details). With SIP disabled, you can reboot and then your commands will be permitted.

answered Apr 28 '16 at 19:53

D Schlachter

1,998

thanks! I decided to change CRL to best attempt to work around – Wingzero Apr 29 '16 at 02:16
what is CRL ? how does it help with the above case ? – gaurav5430 Jun 12 '20 at 12:41

score 1 · Answer 2 · answered Feb 17 '21 at 00:52

1

Disable SIP in the recovery mode:

csrutil disable

Reboot and then:

sudo mount -uw /
killall Finder

Now you should be able to remove certificates.

answered Feb 17 '21 at 00:52

Sasha Kozlov

111

security: SecKeychainItemDelete: UNIX[Operation not permitted] on OS X when trying to remove a system root expired cert

2 Answers2

Linked