Removing System Root certificates (is probably a bad idea)

sudo mount -uw /

#!/bin/bash



# variables & text / ops functions
keychn='/System/Library/Keychains/SystemRootCertificates.keychain'

txtack(){ printf "\nCertificate deleted!\n\n" ; }
txtcrt(){ printf "\nUse one of the following options to identify a System Root Certificate for deletion:\n\n1) Common Name\n2) SHA-1 hash\n\n" ; }
txtdel(){ printf "Do you want to permanently delete the following System Root certificate?\n\n%s\n%s\n\nType \"yes\" at the prompt to delete or \"no\" to cancel...\n\n" "$dspnam" "$dsphsh" ; }
txtent(){ printf "\nPlease enter \"1\" or \"2\". Thanks.\n\n" ; }
txterr(){ printf "ERROR: this certificate could not be found in the keychain.\n\n" ; }
txtmth(){ printf "\nPaste in the %s of the System Root Certificate you would like to delete.\nThe %s can be copied by secondary clicking on the certificate in Keychain\nAccess & selecting \"Get Info\":\n\n" "$method" "$method" ; }
txtnot(){ printf "The certificate was not deleted.\n\n" ; }
txtsip(){ printf "\nERROR: System Integrity Protection must be disabled to delete System Root\ncertificates. Restart the computer from the Recovery HD to disable SIP.\n" ; }
txtusr(){ printf "\nERROR: this script must be executed by the root user or with sudo!\n" ; }
txtyrn(){ printf "Please enter \"yes\" or \"no\". Thanks.\n\n" ; }

chkchk(){
    /usr/bin/clear

    if [ "$EUID" -ne 0 ]
    then
        txtusr; exit
    elif /usr/bin/csrutil status | /usr/bin/grep -i -q enabled
    then
        txtsip; exit
    fi

    macosx="$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F '.' '{print $2}')"
    macos11="$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F '.' '{print $1}')"

    if [ "$macosx" -gt 14 ] || [ "$macos11" -gt 11 ]
    then
        /sbin/mount -uw -o nobrowse / 2>&1 /dev/null
    fi
}

delcrt(){
    txtdel
    while true
    do
        read -r -p "delete> " yesno; echo
        case "$yesno" in
            YES | Yes | yes ) /usr/bin/security delete-certificate -Z "$shastr" "$keychn" ; txtack; exit ;;
            NO  | No  | no  ) txtnot; exit ;;
                          * ) txtyrn ;;
        esac
    done
}

delnam(){
    method="Common Name"
    
    txtmth; read -r -p "Common Name> " input; echo
    
    output="$(echo "$input" | /usr/bin/sed -e "s/'//g" -e 's/"//g')"
    shastr="$(/usr/bin/security find-certificate -c "$output" -Z "$keychn" | /usr/bin/awk '/SHA-1 hash:/{print $NF}')"
    
    if [ -z "$shastr" ]
    then
        echo; exit
    fi
    
    dsphsh="SHA-1 hash: $shastr"
    dspnam="Common Name: $output"
}

delsha(){
    method="SHA-1 hash"
    
    txtmth; read -r -p "SHA-1 hash> " input; echo
    
    shastr="$(echo "$input" | /usr/bin/awk '{gsub (" ","",$0); print}')"
    
    if /usr/bin/security find-certificate -a -Z "$keychn" | /usr/bin/grep -qx "SHA-1 hash: $shastr"
    then
        dsphsh="SHA-1 hash: $shastr"
        dspnam="Common Name: $(/usr/bin/security find-certificate -a -Z "$keychn" | /usr/bin/grep -A10 "$shastr" | /usr/bin/awk '   /"alis"<blob>="/{print substr ($0,18)}')"
    else
        txterr; exit
    fi
}

fixmnt(){
    if [ "$macosx" -gt 14 ] || [ "$macos11" = 11 ]
    then
        /sbin/mount -ur / 2>&1 /dev/null
    fi
}



# operations
chkchk; txtcrt
while true
do
    read -r -p "option> " option
    case "$option" in
        1 ) delnam; delcrt ;;
        2 ) delsha; delcrt ;;
        * ) txtent ;;
    esac
done
fixmnt