Add certificate authorities system-wide on Firefox
I want to add some root CAs that doesn't come with the default firefox on Ubuntu, but I don't know how.
I tried adding them to the local certificates with certutil, but it didn't work. It messed up my certificates database.
$ certutil -A -d .mozilla/firefox/kek3dogy.default/ -i /usr/local/share/ca-certificates/FNMT_ACRAIZ.crt -n "Certificado Raiz FNMT" -t "TCu,Cuw,Tuw"
and then
$ certutil -L -d .mozilla/firefox/kek3dogy.default/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Go Daddy Secure Certification Authority ,,
VeriSign Class 3 Secure Server CA - G3 ,,
VeriSign Class 3 Extended Validation SSL CA ,,
DigiCert High Assurance CA-3 ,,
GlobalSign Domain Validation CA - G2 ,,
GeoTrust SSL CA ,,
StartCom Class 2 Primary Intermediate Server CA ,,
Google Internet Authority ,,
Certificado Raiz FNMT CT,C,c
USERTrust Legacy Secure Server CA ,,
HP Jetdirect 2B0EAD20 ,,
Akamai Subordinate CA 3 ,,
VeriSign, Inc. ,,
Thawte SGC CA ,,
VeriSign Class 3 Secure Server CA - G2 ,,
The certificate won't show up on Firefox. I tried this several times, even deleting the profile, and it showed up once on the Firefox interface, but completely empty.
Anyways, that's only for a user, and I want to add them system-wide. Is there a system-wide database I can modify? How?
If there is no system-wide database I can modify, I can rely on a X start script (as /etc/X11/Xsession.d/ ones, or a script called by the xdg autostart system on /etc/xdg/autostart/) to modify the user profile at session start, but I need a solution that works. I can't even load certificates on the user profiles from the command line now!
The problem here is that Firefox does not have a 'central' location where it looks for certificates. It just looks into the current profile. That's why modifying /usr/share/ca-certificates or other similar directories won't work with Firefox. This is something that has been requested for years; see issues 620373, 449498 and 454036 (and probably there are many others).
So you are left with just two kind of solutions: either modify each profile, or modify the behaviour of Firefox. I know this is not what you are looking for, but there are no ways because Firefox only looks at users' profiles.
Having said that, the solution I would choose is using hard or symbolic links, specifically I'd go with hardlinks. This solution is surely the easiest and probably the better, though I don't have enough information to judge.
What you have to do is basically removing each cert8.db and key3.db files for each profile and replace them with links to the "most complete" cert8.db and key3.db. If you go with hardlinks, the original cert8.db and key3.db will be indistinguishable from the new ones.
Remember to adjust permissions to fit your needs. Most likely, you will need to chmod a+rw so that everybody will be able to add/remove a certificate. If you want only certain users to be able to add/remove certificates, you can create a group, assign the two databases to that group and give +w permission just to the group.
The easiest way is to import the certificate into a sample firefox-profile and then copy the cert8.db to the users you want equip with the certificate.
First import the certificate by hand into the firefox profile of the sample-user. Then copy
/home/${USER}/.mozilla/firefox/${randomalphanum}.default/cert8.db
into the users firefox-profiles. That's it. If you want to make sure, that new users get the certificate automatically, copy cert8.db to:
/etc/firefox-3.0/profile
Here is an alternative way that doesn't override the existing certificates: [bash fragment for linux systems]
certificateFile="MyCa.cert.pem"
certificateName="MyCA Name"
for certDB in $(find ~/.mozilla* ~/.thunderbird -name "cert8.db")
do
certDir=$(dirname ${certDB});
#log "mozilla certificate" "install '${certificateName}' in ${certDir}"
certutil -A -n "${certificateName}" -t "TCu,Cuw,Tuw" -i ${certificateFile} -d ${certDir}
done
You may find certutil in the libnss3-tools package (debian/ubuntu).
See also: Programmatic import of CA Certificate
Source: Programmatically Install Certificate into Mozilla
Contrary to popular belief, you can get Firefox to look at the system certificates instead its own hard-coded set.
To do this, you will want to use a package called p11-kit. p11-kit provides a drop-in replacement for libnssckbi.so, the shared library that contains the hardcoded set of certificates. The p11-kit version instead reads the certificates from the system certificate store.
Since Firefox ships with its own version of libnssckbi.so, you'll need to track it down and replace it instead of the version provided in libnss3:
sudo mv /usr/lib/firefox/libnssckbi.so /usr/lib/firefox/libnssckbi.so.bak
sudo ln -s /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so /usr/lib/firefox/libnssckbi.so
Next, delete the ~/.pki directory to get Firefox to refresh its certificate database (causing it to pull in the system certs) upon restarting Firefox. Note: this will delete any existing certificates in the store, so if have custom ones that you added manually, you might want to back up that folder and then re-import them.
Found this solution to add certificates to firefox on ubuntu :
https://github.com/mozilla/policy-templates/#proxy
Simply need to add this file to :
/usr/lib/firefox/distribution/
touch policies.json
In policies.json add:
{
"policies": {
"Certificates": {
"ImportEnterpriseRoots": true,
"Install": [
"somecert1.crt",
"usr/local/share/ca-certificates/somecert1.crt"
]
}
}
}
The install part is first the name of the cert and then the path. And restart firefox. If something doesn't work try resetting firefox as if you have set something before it can stuck it.
This method works good without certutil.