Hi, When you say FF still complains :( can you please provide a screenshot of the error, we will need some more info to help.

For reference:

• https://www.mozilla.org/en-US/about/g.../policy/

Note, real question might be was config entries need to be disabled.

Hi, thanks for reply!

By "FF still complains" I mean standard error page "This Connection is Untrusted" with, or without, "Add exception" button.

To give you a real example:

I have current certificate for support.mozilla.org (SHA-256 = 2F:D5:63:1B:B0:CF:A0:1E:86:B3:F2:78:F1:0B:00:6F:5A:4B:E2:58:50:10:5E:0B:A3:A8:6E:4B:C4:5F:9F:1B) manually imported in Preferences->Advanced->Certificates->View Certificates->Servers list. I also have the root CA for this certificate (DigiCert High Assurance EV Root CA) distrusted (all 3 bits off).

But when I connect to the https://support.mozilla.org, I get the Untrusted Connection error page.

I want to set that the *manually imported* certificate (identified by checksums etc) would allow the connection even if his root CA is distrusted.

Any ideas how to do set it?

Thanks!

Only if trust bit(s) are set then you can trust a website. You would normally have the trust bits set on a built-in root certificate. I assume that you would have to import the certificate under the authorities tab and set its trust bits to trust websites.

I don't know for what reason you have distrusted all built-in root certificates, but doing that doesn't make this easier.

> I don't know for what reason you have distrusted all built-in root certificates, but doing that doesn't make this easier.

I explained this at the beginning. I want to trust only to manually imported certificates, not to any certificate from the root CAs. So the "set root CA's trust bits on" is not a solution. I hope it is clearer now.

Yes, both senarios are recognized as mis-issued in Mozilla's CA certificate policy. Mentioned here

OK, thanks for your time.

The solution is: add the certificate exception in non-private firefox window. After restart, the cert is in cert_override.txt file in profile folder and Firefox connects to the server even if the root CA trust bits are disabled.

This is exactly the behavior I was looking for :)