Mozilla Firefox "Edit Trust..." on company certificates

[Skriaudejas]

Hello,

I am struggling to have Mozilla Firefox (58.0.2) latest version enable company's certificates. We have 4 proxy certificates and they are available in Keychain "System" certificates list, but Mozilla Firefox does not pick them up, they have to be manually imported.

If I put cert9.db and prefs.js files into user profile, 4 certificates are being added to Firefox, but they don't have the tick on "This certificate can identify web sites." and therefore 4 certificates don't work. Is there any way to modify the "Edit Trust..." settings silently so that users don't have to go to settings and manually enable certs?

Or is there any alternative to achieve what I am trying to besides the 2 mentioned files (cert9.db and prefs.js)?

P.S. Note that CCK2 is not an option as it is not compatible with the latest Firefox version 58.0.2

[rqomsiya]

Hi @Skriaudejas ,

You need to follow these instructions here:
https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment_before_60

You will need to use a .js and .cfg file. I have one cert I use for my proxy and you can add that in the .js file.

My .js file looks like this

// Any comment. You must start the file with a comment!
pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0);

And my mozilla.cfg file looks like this. See the last "//" for cert import:

// Any comment. You must start the file with a comment!

// Disable updater
lockPref("app.update.enabled", false);
// make absolutely sure it is really off
lockPref("app.update.auto", false);
lockPref("app.update.mode", 0);
lockPref("app.update.service.enabled", false);

// Disable Add-ons compatibility checking
clearPref("extensions.lastAppVersion"); 

// Don't show 'know your rights' on first run
pref("browser.rights.3.shown", true);

// Don't show WhatsNew on first run after every update
pref("browser.startup.homepage_override.mstone","ignore");


// Disable the internal PDF viewer
pref("pdfjs.disabled", true);

// Disable the flash to javascript converter
pref("shumway.disabled", true);

// Don't ask to install the Flash plugin
pref("plugins.notifyMissingFlash", false);

//Disable plugin checking
lockPref("plugins.hide_infobar_for_outdated_plugin", true);
clearPref("plugins.update.url");

// Disable health reporter
lockPref("datareporting.healthreport.service.enabled", false);

// Disable all data upload (Telemetry and FHR)
lockPref("datareporting.policy.dataSubmissionEnabled", false);

// Disable crash reporter
lockPref("toolkit.crashreporter.enabled", false);
Components.classes["@mozilla.org/toolkit/crash-reporter;1"].getService(Components.interfaces.nsICrashReporter).submitReports = false; 

// Dont show WhatsNew on first run after every update
pref("browser.startup.homepage_override.mstone","ignore");

// Add Certs
var Cc = Components.classes;
var Ci = Components.interfaces;
var certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB);
var certdb2 = certdb;
try {
    certdb2 = Cc["@mozilla.org/security/x509certdb;1"].getService(Ci.nsIX509CertDB2);
} catch (e) {}
cert="MIIEfTCCA2WgAwIBAgIJAI4dL87GTVCRMA0GCSqGSIb3DQEBCwUAMIHUMQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxFDASBgNVBAcMC1NhbiBBbnRvbmlvMSgwJgYDVQQKDB9UaGUgQ2FwaXRhbCBHcm91cCBDb21wYW5pZXMgSW5jMRswGQYDVQQLDBJOZXR3b3JrIE9wZXJhdGlvbnMxKDAmBgNVBAMMH0NhcGdyb3VwIFByaXZhdGUgU0hBMjU2IFJvb3QgQ0ExLjAsBgkqhkiG9w0BCQEWH05ldHdvcmsuT3BlcmF0aW9uc0BjYXBncm91cC5jb20wHhcNMTYxMTE2MjEwMzA2WhcNMjExMTE1MjEwMzA2WjCB1DELMAkGA1UEBhMCVVMxDjAMHEMBwZvC8Q/RuiSa9swhp7qzujV7YeKp/hi2tk+d7pWbYL50v7LkuXLrt3l60Hh5iBlIrEUJZer/thKw+cMoFlyUGvdhck9TEuvbudtCF3OPUKXTa/f/eSnP2k8zQNl6Nf9PNW6Po90w=="; // This should be the certificate content with no line breaks at all.
certdb.addCertFromBase64(cert, "C,C,C", "");

I took out some chunks from my cert, but it should be in that format. The last line "certdb.addCertFromBase64(cert, "C,C,C", "");" is what sets the trust for web sites.

Also note, that the cert has to be pasted with no line breaks.

Its kinda a pain, but once you have the files you can just re-use them with any future deployments of FF.