security: SecKeychainItemDelete: UNIX[Operation not permitted] on OS X when trying to remove a system root expired cert

Question

So I see some expired certs under 'System Roots' (not 'System'), so I want to delete them via cmd.

sudo security delete-certificate -c A-Trust-nQual-01 /System/Library/Keychains/SystemRootCertificates.keychain

However bash reports

security: SecKeychainItemDelete: UNIX[Operation not permitted]

I entered the correct password for sudo for sure. How can I proceed?

OS: latest MAC OS X release, not beta.

Update: I even tried with sudo su as root, still not work:

sh-3.2# security delete-certificate -c A-Trust-nQual-01 /System/Library/Keychains/SystemRootCertificates.keychain 
security: SecKeychainItemDelete: UNIX[Operation not permitted]
sh-3.2# whoami
root
sh-3.2# 

Solution 1

It's just System Integrity Protection (SIP) that prevents even root from modifying the contents of /System — you can toggle it by booting to the Recovery Partition (reboot holding Command-R) and then running csrutil disable command in the Terminal (more details). With SIP disabled, you can reboot and then your commands will be permitted.

Solution 2

Disable SIP in the recovery mode:

csrutil disable

Reboot and then:

sudo mount -uw /
killall Finder

Now you should be able to remove certificates.

Comments

[Wingzero]

thanks! I decided to change CRL to best attempt to work around

[gaurav5430]

what is CRL ? how does it help with the above case ?