Trusting an internal CA in the System keychain

For one machine the command line is fine. For a fleet, push it as a profile so trust is managed and cannot be casually removed by the user.

One machine

# add to the System keychain and mark it trusted for SSL
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain CorpRootCA.cer

Use -r trustRoot for a root and -r trustAsRoot for an intermediate you want treated as an anchor. Verify with security verify-cert -c server.cer.

At scale

Wrap the DER cert in a com.apple.security.pkcs1 payload inside a configuration profile and deploy it through MDM. A managed profile also lets you preset the trust settings, which the manual command cannot do without a click-through prompt on newer macOS.

# get the raw payload data for the profile
base64 -i CorpRootCA.cer | pbcopy

Note that trusting the root does not automatically make it valid for every purpose. If EAP or 802.1X still complains, check the certificate trust settings for that specific use, not just the general SSL flag.