SSL: Fix macOS Trust Certificate button hidden for untrusted CAs

[gavande1]

Related issues

• Fixes STU-2053

How AI was used in this PR

Claude wrote the code, guided by the author. The author tested it locally and manually reviewed it before pushing.

Proposed Changes

On macOS, the Trust Certificate button disappeared after enabling HTTPS even when the certificate was not actually trusted, so the browser kept showing a security warning with no way to resolve it. The trust check validated the certificate against itself rather than the system Keychain, so it always reported success. It now evaluates against the real system trust store, so the button stays until the certificate is genuinely trusted.

Testing Instructions

The bug reproduces only on macOS versions where security verify-cert -r <ca> -p ssl returns 0 for an untrusted certificate, so it may not appear on every Mac. To prove the fix deterministically, run the exact command the app uses in both trust states.

1. Check out this branch.
2. Start the app
3. Enable HTTPS on a site so ~/.studio/certificates/studio-ca.crt exists.
4. Now go to terminal and run following commands
5. Untrusted state, the fixed check must report not trusted:
   security verify-cert -c ~/.studio/certificates/studio-ca.crt -p ssl -l; echo $? returns 1.
   In the app, the Trust Certificate button is shown.
6. Trust the certificate:
   sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ~/.studio/certificates/studio-ca.crt
7. Trusted state, the fixed check must report trusted:
   security verify-cert -c ~/.studio/certificates/studio-ca.crt -p ssl -l; echo $? returns 0.
   In the app, the button is hidden.
8. Regression: the Windows and Linux trust flows are untouched, so there is no behavior change there.

Tests: npm test -- apps/cli/lib/tests/certificate-manager.test.ts runs all 12 and they pass.

Reset (to re-test):

sudo security remove-trusted-cert -d ~/.studio/certificates/studio-ca.crt
sudo security delete-certificate -c "WordPress Studio CA" /Library/Keychains/System.keychain

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing 2929072 vs trunk

app-size

Metric	trunk	2929072	Diff	Change
App Size (Mac)	1352.92 MB	1352.92 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	2929072	Diff	Change
load	1085 ms	1132 ms	+47 ms	⚪ 0.0%

site-startup

Metric	trunk	2929072	Diff	Change
siteCreation	6477 ms	6974 ms	+497 ms	🔴 7.7%
siteStartup	2395 ms	2392 ms	3 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

[bcotrim]

LGTM 👍