Using the "trust" Command (with examples)

The trust command is a useful tool for operating on the trust policy store. It allows you to manage and manipulate trust anchors, certificates, and trust policies. In this article, we will explore different use cases of the trust command with code examples for each case.

Use Case 1: List trust policy store items

trust list

Motivation: This command is useful when you want to see all the items in the trust policy store.

Explanation: The list subcommand is used to display a list of items in the trust policy store. It provides information about the blocklist, CA anchors, certificates, and trust policies.

Example Output:

blocklist:
- example.com
- malicious-site.com

ca-anchors:
- CA1.crt
- CA2.crt

certificates:
- cert1.crt
- cert2.crt

trust-policy:
- policy1.json
- policy2.json

Use Case 2: List information about specific items in the trust policy store

trust list --filter=blocklist

Motivation: Sometimes, you may only need information about specific items in the trust policy store, such as the blocklist.

Explanation: The --filter option allows you to specify the type of items you want to list. In this example, we are using the blocklist filter to list all the items in the blocklist.

Example Output:

blocklist:
- example.com
- malicious-site.com

Use Case 3: Store a specific trust anchor in the trust policy store

trust anchor path/to/certificate.crt

Motivation: When you want to add a trust anchor to the trust policy store, you can use this command. Trust anchors are used to establish trust in X.509 certificates.

Explanation: The anchor subcommand is used to store a specific trust anchor in the trust policy store. The argument path/to/certificate.crt represents the path to the certificate file that you want to add as a trust anchor.

Example Output: (No output)

Use Case 4: Remove a specific anchor from the trust policy store

trust anchor --remove path/to/certificate.crt

Motivation: If you want to remove a trust anchor from the trust policy store, you can use this command.

Explanation: The --remove option is used to indicate that you want to remove an anchor from the trust policy store. The argument path/to/certificate.crt represents the path to the certificate file that you want to remove.

Example Output: (No output)

Use Case 5: Extract trust policy from the shared trust policy store

trust extract --format=x509-directory --filter=ca-anchors path/to/directory

Motivation: This command is useful when you want to extract the trust policy from the shared trust policy store and save it in a specific format.

Explanation: The extract subcommand is used to extract the trust policy from the shared trust policy store. The --format option is used to specify the format of the output. In this example, we are using the x509-directory format. The --filter option is used to specify the type of items to extract. In this case, we are extracting the CA anchors. The argument path/to/directory represents the directory where the extracted trust policy will be saved.

Example Output: (No output)

Use Case 6: Display help for a subcommand

trust subcommand --help

Motivation: If you need help or information about a specific subcommand, you can use this command.

Explanation: The --help option is used to display help information for a specific subcommand. Replace “subcommand” in the command with the actual subcommand you want to get help for.

Example Output: (Help information for the specified subcommand)