How to make Firefox trust my companies certificate on my machine?

Question

I would like to use Mozilla Firefox on Ubuntu 20.04, the problem is to make Firefox trust my companies certificate.

First I installed the root/CA certificate as described in this answer That alone didn't work, so I continued with this Mozilla support article. The Linux section is very short, so I just tried to set security.enterprise_roots.enabled to true.

I also added the certificate to /usr/share/ca-certificates/mozilla.

When I try to go to that internal website, I get:

Warning: Potential Security Risk Ahead

Firefox detected a potential security threat and did not continue to hostname.internal. If you visit this site, attackers could try to steal information like your passwords, emails, or credit card details.

What can you do about it?

The issue is most likely with the website, and there is nothing you can do to resolve it.

If you are on a corporate network or using anti-virus software, you can reach out to the support teams for assistance. You can also notify the website’s administrator about the problem.

I have also tried the following in order to verify that installing the certificate to the OS worked. Seems like it didn't...

$ curl -I https://hostname.internal/
HTTP/1.1 200 Connection established

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

Can anybody shed some light on whats going on and maybe provide some further steps that I could do to analyze the problem?

Answer 1

Firefox has it's own certificate store and does not use the system-wide certificates in /usr/share/ca-certificates, so the first answer you linked has no impact on Firefox. (It is also clearly said in the comments to the answer that you linked)

The second article from Mozilla seems too complicated for me.

It should work the following way (at least it works for me):

In Firefox, go to Preferences -> Privacy & Security -> Certificates -> View Certificates -> Import. Select the file with your certificate. Firefox should ask you under which category it should store the certificate, select "Authorities". Or it will maybe recognize by itself that it's a CA certfifcate and put it under the appropriate category. After you finish the import process, you can check if your imported certificate is visible in the "Authorities" section.

There are also more answers regarding Firefox here: Add certificate authorities system-wide on Firefox

Answer 2

You can enable the Enterprise Roots preference which then allows Firefox to use the operating system CA Root certificates.

It seems this is a new feature designed to workaround problems with vendors lagging behind registering their certificates with Firefox. Firefox will automatically turn this on when there's a TLS error to see if it fixes it.

about:config 
security.enterprise_roots.enabled = true

and security.certerrors.mitm.auto_enable_enterprise_roots enables the behaviour of Firefox automatically trying to turn this on during TLS failure.

I found this article because Firefox did do this - it found my personal dev CA certificate in the Mac OS keychain and enabled this feature, while I was trying to install my CA cert into firefox (as per the accepted answer). In the address bar under the padlock icon, it says "Connection verified by a certificate authority that is not recognised by Mozilla" and a link to the article.

https://mzl.la/3vVLmzx