How to add a self-signed root CA and always trust it from CLI on OSX I succeeded importing a root CA to the keychain with

sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" CA.crt


But it's marked as Use System Defaults, like



How can I mark it as Always Trust from CLI?
It seems that the only way to modify the trust settings via the security command is by the trust-settings-import option.  The xml file output by security trust-settings-export would be a good place to start; but, it looks a little tricky.