This script downloads a public certificate from a remote server over SSH and then adds it to the local trust store.

download-trust-cert.sh

#!/bin/bash

REMOTE_CRT="/etc/ssl/certs/squidCA.crt"
REMOTE_URL="root@192.168.20.1"
FILENAME=`basename "$REMOTE_CRT"`
LOCAL_CRT="/tmp/$FILENAME"
KEYCHAIN="$HOME/Library/Keychains/login.keychain"
# More information about this here:
# http://lists.apple.com/archives/macos-x-server/2008/Feb/msg00187.html
SECURITY_TYPE="trustAsRoot"

echo "Remote Server: $REMOTE_URL"
echo "Remote Cert: $REMOTE_CRT"

# Request sudo access
if [[ $EUID -ne 0 ]]; then
   sudo -n true 2> /dev/null || { echo "We need root access for adding trusted certificate"; }
   sudo -p "Password: " true || { echo "Error Getting Root!"; exit 1; }
fi

# Download the Certificate First
printf "Downloading Remote Certificate... "
scp -q "${REMOTE_URL}:${REMOTE_CRT}" "$LOCAL_CRT" && printf "[Done]\n" || { printf "[Failed!]\n"; exit 1; }

# Trust the Certificate
printf "Adding Certificate to Root Trust Store... "
sudo security add-trusted-cert -d -k "$KEYCHAIN" -r $SECURITY_TYPE "$LOCAL_CRT" && printf "[Done]\n" || { printf "[Failed!]\n"; exit 1; }
#rm "$LOCAL_CRT" 2> /dev/null

echo "All Tasks Done!"