MacOS – How to install subordinate CA certificate into keychain from Terminal

The question appears to be specific to using X.509 for authentication to an IMAP service, which isn't supported by iOS. S/MIME email encryption and signatures can be performed on iOS, but the authentication to mail services will still use username/password over SSL or TLS.

I think it works with the following command:

xar --dump-toc="${HOME}/Desktop/header.xml" -f /path/to/your/archive.xip

This will write an xml file called "header" onto your desktop, and that one contains the X509 certificates. You only need to parse it; maybe jq will do the job best.

Edit: however, jq isn't native macOS, so it has to be with xmllint etc. This below works. It will put all certificates in your home folder.

FILEPATH="/path/to/your/archive.xip"
FILENAME=$(/usr/bin/basename "$FILEPATH")
/usr/bin/xar --dump-toc=- -f "$FILEPATH" \
    | /usr/bin/xmllint --xpath '//signature[@style="RSA"]' - \
    | /usr/bin/sed -n '/<X509Certificate>/,/<\/X509Certificate>/p' \
    | xargs \
        | /usr/bin/awk '{ \
                gsub("<X509Certificate>","-----BEGINCERTIFICATE-----"); \
                gsub("</X509Certificate>","-----ENDCERTIFICATE-----"); \
                print}' \
        | /usr/bin/awk '{gsub(" ","\n"); print}' \
        | /usr/bin/awk '{ \
                gsub("BEGINCERTIFICATE-----","BEGIN CERTIFICATE-----\n"); \
                gsub("-----ENDCERTIFICATE","\n-----END CERTIFICATE"); \ 
                print}' \
    | /usr/bin/csplit -k -s -n 1 -f "$FILENAME"-cert - '/END CERTIFICATE/+1' '{3}' 2>/dev/null
for CERT in *"-cert"* ; do
    if [[ $(/bin/cat "$CERT") == "" ]] ; then
        rm -rf "$CERT"
    else
        mv "$CERT" "$CERT.pem"
    fi
done