Programmatically Install Certificate into Mozilla

user_148520 0
Viewed 114308

Is there a way to programmatically install a certificate into mozilla? We're trying to script everything to eliminate deviations in environment so installing it by hand through mozilla preferences does not work for our needs. I assume theres a way to do it with certutil, but I am not sure of Mozilla's internals, etc.

firefox certificate
9 Answers

Firefox now (since 58) uses a SQLite database cert9.db instead of legacy cert8.db. I have made a fix to a solution presented here to make it work with new versions of Firefox:

certificateFile="MyCa.cert.pem"
certificateName="MyCA Name" 
for certDB in $(find  ~/.mozilla* ~/.thunderbird -name "cert9.db")
do
  certDir=$(dirname ${certDB});
  #log "mozilla certificate" "install '${certificateName}' in ${certDir}"
  certutil -A -n "${certificateName}" -t "TCu,Cuw,Tuw" -i ${certificateFile} -d sql:${certDir}
done
user_50901450

Recent versions of Firefox support a policies.json file that will be applied to all Firefox profiles.

For CA certificates, you have some options, here's one example, tested with Linux/Ubuntu where I already have system-wide CA certs in /usr/local/share/ca-certificates:

In /usr/lib/firefox/distribution/policies.json

{
    "policies": {
        "Certificates": {
            "Install": [
                "/usr/local/share/ca-certificates/my-custom-root-ca.crt"
            ]
        }
    }
}

Support for Thunderbird is on its way.

user_12542920

I have an update of this awesome answer (just not working any more with last Firefox updates), in this same thread, made by H.-Dirk Schmitt, also thanks to the answer in this other thread made by BecarioEstrella.

I just adapted the script to recent changes.

Tested in 2021 just in Firefox 85.0.1 (64bit) in Ubuntu 20.04 and 18.04.

#!/usr/bin/env bash

function usage {
  echo "Error: no certificate filename or name supplied."
  echo "Usage: $ ./installcerts.sh <certname>.pem <Cert-DB-Name>"
  exit 1

}

if [ -z "$1" ] || [ -z "$2" ]
  then
    usage
fi

certificate_file="$1"
certificate_name="$2"
for certDB in $(find  ~/.mozilla* ~/.thunderbird -name "cert9.db")
do
  cert_dir=$(dirname ${certDB});
  echo "Mozilla Firefox certificate" "install '${certificate_name}' in ${cert_dir}"
  certutil -A -n "${certificate_name}" -t "TCu,Cuw,Tuw" -i ${certificate_file} -d sql:"${cert_dir}"
done

If you want it just for Firefox, replace the line:

for certDB in $(find  ~/.mozilla* ~/.thunderbird -name "cert9.db")

By

for certDB in $(find  ~/.mozilla* -name "cert9.db")

Further readings:

user_15509300
Related