Tìm kiếm hỗ trợ

Tránh các lừa đảo về hỗ trợ. Chúng tôi sẽ không bao giờ yêu cầu bạn gọi hoặc nhắn tin đến số điện thoại hoặc chia sẻ thông tin cá nhân. Vui lòng báo cáo hoạt động đáng ngờ bằng cách sử dụng tùy chọn "Báo cáo lạm dụng".

Learn More

Enterprise root certs support for firefox in linux

  • 4 trả lời
  • 1 gặp vấn đề này
  • 16 lượt xem
  • Trả lời mới nhất được viết bởi mozilladev

more options

I am trying to access sites whose certificates are issued by a local CA in firefox 70 version in RHEL 7 machine. I have added this CA cert to linux system certificate store. But I am not able to access the site and I see MOZILLA_PKIX_ERROR_MITM_DETECTED error in the webpage.

In windows and Mac I was able to make it work by setting the option security.enterprise_roots.enabled to true in preferences file and adding the root cert in system key store. But seems this option is not available in linux.

If I import this certificate manually in firefox UI (Preferences -> Certificate Manager -> Authorities and Import), I was able to access the site. But I am looking for a programatic way or by setting some config changes from code.

I am looking for this option in both RHEL and Ubuntu flavours. (Not sure whether the kernel flavour will make any difference).

Could you please help me in identifying the correct config options or steps to make Firefox trust this certificate.

Thanks

Tất cả các câu trả lời (4)

more options
more options

Yes, I tried. I created distribution folder in firefox folder, and created policies.json file inside distribution folder with the following content.

{

 "policies": {
   "Certificates": {
     "ImportEnterpriseRoots": true 
     "Install": ["cert1.crt"]
   }
 }

}

and I copied the cert1.crt to the location given for linux, like /usr/lib/mozilla/certificates etc., But still observing the same issue.

Thanks

more options

Did you try to specify the full path to the certificate ?

{
  "policies": {
    "Certificates": {
      "Install": ["cert1.der", "/home/username/cert2.pem"]
    }
  }
}
more options

Yes, I tried that one as well.