<!--
{
  "availability" : [
    "macOS: 10.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "Security",
  "identifier" : "/documentation/Security/SecTrustOptionFlags",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Security"
    ],
    "preciseIdentifier" : "c:@E@SecTrustOptionFlags"
  },
  "title" : "SecTrustOptionFlags"
}
-->

# SecTrustOptionFlags

The option flags used to condition a trust evaluation.

```
struct SecTrustOptionFlags
```

## Overview

Use these flags in calls to the [`SecTrustSetOptions(_:_:)`](/documentation/Security/SecTrustSetOptions(_:_:)) function.

## Topics

### Initializers

[`init(rawValue:)`](/documentation/Security/SecTrustOptionFlags/init(rawValue:))

Initializes a trust option flags structure.

### Flags

[`allowExpired`](/documentation/Security/SecTrustOptionFlags/allowExpired)

Allow expired certificates (except for the root certificate).

[`leafIsCA`](/documentation/Security/SecTrustOptionFlags/leafIsCA)

Allow CA certificates as leaf certificates.

[`fetchIssuerFromNet`](/documentation/Security/SecTrustOptionFlags/fetchIssuerFromNet)

Allow network downloads of CA certificates.

[`allowExpiredRoot`](/documentation/Security/SecTrustOptionFlags/allowExpiredRoot)

Allow expired root certificates.

[`requireRevPerCert`](/documentation/Security/SecTrustOptionFlags/requireRevPerCert)

Require a positive revocation check for each certificate.

[`useTrustSettings`](/documentation/Security/SecTrustOptionFlags/useTrustSettings)

Use TrustSettings instead of anchors.

[`implicitAnchors`](/documentation/Security/SecTrustOptionFlags/implicitAnchors)

Treat properly self-signed certificates as anchors implicitly.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)