View source for CA:AddRootToFirefox

= Installing Certificates Into Firefox =

There are lots of organizations that use their own certificate authorities (CAs) to issue certificates for their internal servers. Since Firefox does not use the operating system's certificate store by default, these have to be manually added into Firefox. This page will cover how to get those CAs into Firefox.

== Experimental Built-in Windows Support ==
As of version 49, Firefox can be experimentally configured to automatically search for and import CAs that have been added to the Windows certificate store by a user or administrator. To do so, set the preference "security.enterprise_roots.enabled" to true. In this mode, Firefox will inspect the HKLM\SOFTWARE\Microsoft\SystemCertificates registry location (corresponding to the API flag CERT_SYSTEM_STORE_LOCAL_MACHINE) for CAs that are trusted to issue certificates for TLS web server authentication. Any such CAs will be imported and trusted by Firefox, although note that they may not appear in the Firefox's certificate manager. It is expected that administration of these CAs (e.g. trust configuration) will occur via built-in Windows tools or other 3rd party utilities. Note also that for such changes to take effect in Firefox either the preference will have to be toggled off and on again or Firefox will have to be restarted. As this feature evolves, this may be handled automatically for ease of use.

As of version 52, Firefox will also search the registry locations HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates and HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates (corresponding to the API flags CERT_SYSTEM_STORE_LOCAL_MACHINE_GROUP_POLICY and CERT_SYSTEM_STORE_LOCAL_MACHINE_ENTERPRISE, respectively).

=== Credits ===
The original content in this wiki page was copied (with permission) from [http://mike.kaply.com/2015/02/10/installing-certificates-into-firefox/ Mike Kaply's Blog].

== CCK2 ==

The easiest way to get your CAs into Firefox is to use [http://mike.kaply.com/cck2/ CCK2]. [http://mike.kaply.com/cck2/ CCK2] allows certificate authorities and server certificates to be installed into the browser. It supports PEM, DER and text. It also allows you to designate certificate overrides (sites where certificate errors are ignored). Just go to the certificate page and point to either a URL or a local file where the certificate is contained.

* CCK2 is a [https://addons.mozilla.org/en-US/firefox/addon/cck2wizard/?src=kaply.com Firefox Add-On]
* [http://mike.kaply.com/addons/cck2/cck2-support/ CCK2 Support]

== AutoConfig via JavaScript ==

If you're using AutoConfig without CCK2, you can still use [https://dxr.mozilla.org/mozilla-central/rev/e17cbb839dd225a2da7e5d5bec43cf94e11749d8/security/manager/ssl/nsIX509CertDB.idl#353 the API] that the CCK2 uses to install certificate authorities.

This is based on knowledge from here:
https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment

Place the [https://bug1359127.bmoattachments.org/attachment.cgi?id=8862864 autoconfig.js] file in one of these directories:
* on Windows    defaults\pref
* on Mac        Firefox.app/Contents/Resources/defaults/pref
* on Linux      defaults/pref

Place the mozilla.cfg file (the autoconfig.js file makes reference to it) besides the Firefox executable:
<pre>
var Cc = Components.classes;
var Ci = Components.interfaces;
var certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
var certdb2 = certdb;
try {
   certdb2 = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB2);
} catch (e) {}

cert = "MIIHPT...zTMVD"; // This should be the certificate content with no line breaks at all.
certdb2.addCertFromBase64(cert, "C,C,C", "");
</pre>

The three Cs mean to trust the certficate for servers, email and objects. The third parameter is the name, but it is ignored. If you want to install binary certificates, things get more complicated. In that case, I'd definitely recommend the [http://mike.kaply.com/cck2/ CCK2].

== PolicyPak ==

[http://www.policypak.com/products/manage-firefox-with-group-policy.html PolicyPak] supports adding certificate authorites to Firefox via Group Policy.

== Preload the certificate databases ==

Some people create a new profile in Firefox, install the certificates they need, and then distribute the various db files (cert8.db, key3.db and secmod.db) into new profiles using [http://mike.kaply.com/2012/03/30/customizing-firefox-default-profiles/ this method]. This is not the recommended approach, and this method only works for new profiles.

== certutil ==

If you're a real diehard, you can use [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Tools/certutil certutil] to update the Firefox certificate databases from the command line.