I want to add some root CAs that doesn't come with the default firefox on Ubuntu, but I don't know how.
I tried adding them to the local certificates with
certutil, but it didn't work. It messed up my certificates database.
$ certutil -A -d .mozilla/firefox/kek3dogy.default/ -i /usr/local/share/ca-certificates/FNMT_ACRAIZ.crt -n "Certificado Raiz FNMT" -t "TCu,Cuw,Tuw"
$ certutil -L -d .mozilla/firefox/kek3dogy.default/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Go Daddy Secure Certification Authority ,, VeriSign Class 3 Secure Server CA - G3 ,, VeriSign Class 3 Extended Validation SSL CA ,, DigiCert High Assurance CA-3 ,, GlobalSign Domain Validation CA - G2 ,, GeoTrust SSL CA ,, StartCom Class 2 Primary Intermediate Server CA ,, Google Internet Authority ,, Certificado Raiz FNMT CT,C,c USERTrust Legacy Secure Server CA ,, HP Jetdirect 2B0EAD20 ,, Akamai Subordinate CA 3 ,, VeriSign, Inc. ,, Thawte SGC CA ,, VeriSign Class 3 Secure Server CA - G2 ,,
The certificate won't show up on Firefox. I tried this several times, even deleting the profile, and it showed up once on the Firefox interface, but completely empty.
Anyways, that's only for a user, and I want to add them system-wide. Is there a system-wide database I can modify? How?
If there is no system-wide database I can modify, I can rely on a X start script (as
/etc/X11/Xsession.d/ ones, or a script called by the xdg autostart system on
/etc/xdg/autostart/) to modify the user profile at session start, but I need a solution that works. I can't even load certificates on the user profiles from the command line now!
profiles.ini? Then you could add your changes to it, and then copy it and
profiles.inito each user directory.
firefox -p- but you have to close Firefox first.