Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

How can I import binary identity certs from the windows 10 cert store into firefox 57?

  • 5 replies
  • 1 has this problem
  • 46 views
  • Last reply by Sublimeload

Sublimeload
Sublimeload
more options

good morning. I cant seem to find any info on this, our CA is in the firefox store and is trusted, but the personal identity certs issued by our CA aren't appearing in FF 57. They are currently in the physical store (HKLM), and can be seen in certutil, MMC, powershell, etc. security.enterprise_roots.enabled set to true doesn't do anything. or any that's how a team mate here was able to get the trusted CAs into FF.

Any guidance at all would be greatly appreciated.

Thank you for your time, and have a great day

good morning. I cant seem to find any info on this, our CA is in the firefox store and is trusted, but the personal identity certs issued by our CA aren't appearing in FF 57. They are currently in the physical store (HKLM), and can be seen in certutil, MMC, powershell, etc. security.enterprise_roots.enabled set to true doesn't do anything. or any that's how a team mate here was able to get the trusted CAs into FF. Any guidance at all would be greatly appreciated. Thank you for your time, and have a great day

All Replies (5)

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

You can set this pref to true on the about:config page to make Firefox import root certificates from the Windows certificate store.

  • security.enterprise_roots.enabled = true

You can open the about:config page via the location/address bar. You can accept the warning and click "I accept the risk!" to continue.

See also:

Sublimeload
Sublimeload Question owner
more options

Sublimeload said

security.enterprise_roots.enabled set to true doesn't do anything

Thank you very much for the reply, but as stated in above, that does nothing. the CA that issued the cert is trusted, but the personal identity cert it issued is not in firefox.

cor-el
cor-el
  • Moderator
  • Top 10 Contributor
more options

What is the certificate chain that Firefox shows?

You can try these steps to inspect the certificate in case Firefox doesn't show this on the error page when you click the blue SSL error text..

  • open the Server tab in the Certificate Manager
    • Options/Preferences -> Privacy & Security -> Certificates: View Certificates -> Servers: "Add Exception"
  • paste the URL of the website (https://xxx.xxx) in it's location field.

Let Firefox retrieve the certificate -> "Get Certificate"

  • click the "View" button and inspect the certificate

You can see detail like the issuer of the certificate and intermediate certificates in the Details tab.

Sublimeload
Sublimeload Question owner
more options

These are personal identity certs that are issued by CAs that are already trusted in the firefox store. the personal identity certs are valid and are not showing up in the firefox store.

Sublimeload
Sublimeload Question owner
more options

in archaic versions of firefox, I would have to export a pfx fromt he windows store, and use certutil or pk12util to manually import the certificate into the SQLite db file firefox used as a cert store. how do I accomplish this in the new firefox