I want to add some root CAs that doesn't come with the default firefox on Ubuntu, but I don't know how.
I tried adding them to the local certificates with certutil
, but it didn't work. It messed up my certificates database.
$ certutil -A -d .mozilla/firefox/kek3dogy.default/ -i /usr/local/share/ca-certificates/FNMT_ACRAIZ.crt -n "Certificado Raiz FNMT" -t "TCu,Cuw,Tuw"
and then
$ certutil -L -d .mozilla/firefox/kek3dogy.default/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Go Daddy Secure Certification Authority ,,
VeriSign Class 3 Secure Server CA - G3 ,,
VeriSign Class 3 Extended Validation SSL CA ,,
DigiCert High Assurance CA-3 ,,
GlobalSign Domain Validation CA - G2 ,,
GeoTrust SSL CA ,,
StartCom Class 2 Primary Intermediate Server CA ,,
Google Internet Authority ,,
Certificado Raiz FNMT CT,C,c
USERTrust Legacy Secure Server CA ,,
HP Jetdirect 2B0EAD20 ,,
Akamai Subordinate CA 3 ,,
VeriSign, Inc. ,,
Thawte SGC CA ,,
VeriSign Class 3 Secure Server CA - G2 ,,
The certificate won't show up on Firefox. I tried this several times, even deleting the profile, and it showed up once on the Firefox interface, but completely empty.
Anyways, that's only for a user, and I want to add them system-wide. Is there a system-wide database I can modify? How?
If there is no system-wide database I can modify, I can rely on a X start script (as /etc/X11/Xsession.d/
ones, or a script called by the xdg autostart system on /etc/xdg/autostart/
) to modify the user profile at session start, but I need a solution that works. I can't even load certificates on the user profiles from the command line now!
Best Answer
The problem here is that Firefox does not have a 'central' location where it looks for certificates. It just looks into the current profile. That's why modifying
/usr/share/ca-certificates
or other similar directories won't work with Firefox. This is something that has been requested for years; see issues 620373, 449498 and 454036 (and probably there are many others).So you are left with just two kind of solutions: either modify each profile, or modify the behaviour of Firefox. I know this is not what you are looking for, but there are no ways because Firefox only looks at users' profiles.
Having said that, the solution I would choose is using hard or symbolic links, specifically I'd go with hardlinks. This solution is surely the easiest and probably the better, though I don't have enough information to judge.
What you have to do is basically removing each
cert8.db
andkey3.db
files for each profile and replace them with links to the "most complete"cert8.db
andkey3.db
. If you go with hardlinks, the originalcert8.db
andkey3.db
will be indistinguishable from the new ones.Remember to adjust permissions to fit your needs. Most likely, you will need to
chmod a+rw
so that everybody will be able to add/remove a certificate. If you want only certain users to be able to add/remove certificates, you can create a group, assign the two databases to that group and give+w
permission just to the group.