Home / server / Questions / 292165
Accepted
Hubert Kario
Asked: 2011-07-21 00:47:39 +0800 CST

How to deploy new CA certificate to Firefox installs

  • 772

Is there a way do deploy remotely new CA certificates to Firefox installs?

In other words, has anything changed since this question was answered Installing a CA certificate on multiple Windows machines (IE/Firefox)

windows deployment firefox domain

1 Answers

  1. Best Answer

    With certutil from NSS Tools [1] you can administer the certificate databases used by softwares like Firefox and Thunderbird [2]:

    certutil.exe -A -n <cert name> -t <trust> -i <cert filepath> -d <firefox/thunderbird profile dirpath)

    Example that adds "mycompany.pem" certificate file as "mycompany" into Firefox profile and set to trusts it as a CA that can issue client certificates for SSL, e-mail and signing (_C,C,C) as well as server certificates for SSL (T_,_,_). Should be done when software is not running.

    certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "C:\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

# Remote profile accessed via administrative share
certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "\\computer\c$\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

    You could also run the first command via PsTools's PsExec.

    NSS Tools sources can be grabbed from https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/ (some Windows binaries can be found on the Internet but given the security nature: it's better to compile it yourself)

    [1]: Network Security Services: https://developer.mozilla.org/docs/NSS/tools/NSS_Tools_certutil

    [2]: They are using a Netscape Communicator database with files cert8.db and key3.db.

    • 1