The Mac OS Keychain stores encrypted passwords and certificates.
In a corporate environment, one would expect corporate IT to push corporate certificate updates to the Mac OS Keychain. So, no (or minimal) intervention would be required from the user.
The command line tool for interacting with the Mac OS Keychain is security. To see the manual for this command, execute the command below.
man security