How can I import binary identity certs from the windows 10 cert store into firefox 57?
good morning. I cant seem to find any info on this, our CA is in the firefox store and is trusted, but the personal identity certs issued by our CA aren't appearing in FF 57. They are currently in the physical store (HKLM), and can be seen in certutil, MMC, powershell, etc. security.enterprise_roots.enabled set to true doesn't do anything. or any that's how a team mate here was able to get the trusted CAs into FF.
Any guidance at all would be greatly appreciated.
Thank you for your time, and have a great day
All Replies (5)
You can set this pref to true on the about:config page to make Firefox import root certificates from the Windows certificate store.
- security.enterprise_roots.enabled = true
You can open the about:config page via the location/address bar. You can accept the warning and click "I accept the risk!" to continue.
See also:
Sublimeload said
security.enterprise_roots.enabled set to true doesn't do anything
Thank you very much for the reply, but as stated in above, that does nothing. the CA that issued the cert is trusted, but the personal identity cert it issued is not in firefox.
What is the certificate chain that Firefox shows?
You can try these steps to inspect the certificate in case Firefox doesn't show this on the error page when you click the blue SSL error text..
- open the Server tab in the Certificate Manager
- Options/Preferences -> Privacy & Security -> Certificates: View Certificates -> Servers: "Add Exception"
- paste the URL of the website (https://xxx.xxx) in it's location field.
Let Firefox retrieve the certificate -> "Get Certificate"
- click the "View" button and inspect the certificate
You can see detail like the issuer of the certificate and intermediate certificates in the Details tab.
These are personal identity certs that are issued by CAs that are already trusted in the firefox store. the personal identity certs are valid and are not showing up in the firefox store.
in archaic versions of firefox, I would have to export a pfx fromt he windows store, and use certutil or pk12util to manually import the certificate into the SQLite db file firefox used as a cert store. how do I accomplish this in the new firefox