How to remove a corrupted Trust Settings Record?

I was trying to add a trusted cert using security add-trusted-cert -d ..., but somehow the Trust Settings Record became corrupted. I can see this whenever I try to add another trusted cert, or when dumping trust settings:

$ sudo security dump-trust-settings -d
SecTrustSettingsCopyCertificates: The Trust Settings Record was corrupted.

I tried restoring the keychain from backup, and then deleting the login keychain completely, but I still get the error. This makes me think the trust settings are stored in another db or something. Any ideas on how I can delete all the trust settings?

Solution 1:

I finally found the Admin trust settings. It's in a file called Admin.plist in the /Library/Security/Trust Settings directory. Deleting this file cleared the error!

There are other files in that directory that are named <UUID>.plist, where UUID is the value of the GeneratedUID key in the user record. You can see this value with this command:

dscl . cat /Users/<short login name> GeneratedUID`

These files store the per-user trust settings.