I want to add some root CAs that doesn't come with the default firefox on Ubuntu, but I don't know how.
I tried adding them to the local certificates with
certutil, but it didn't work. It messed up my certificates database.
$ certutil -A -d .mozilla/firefox/kek3dogy.default/ -i /usr/local/share/ca-certificates/FNMT_ACRAIZ.crt -n "Certificado Raiz FNMT" -t "TCu,Cuw,Tuw"
$ certutil -L -d .mozilla/firefox/kek3dogy.default/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Go Daddy Secure Certification Authority ,, VeriSign Class 3 Secure Server CA - G3 ,, VeriSign Class 3 Extended Validation SSL CA ,, DigiCert High Assurance CA-3 ,, GlobalSign Domain Validation CA - G2 ,, GeoTrust SSL CA ,, StartCom Class 2 Primary Intermediate Server CA ,, Google Internet Authority ,, Certificado Raiz FNMT CT,C,c USERTrust Legacy Secure Server CA ,, HP Jetdirect 2B0EAD20 ,, Akamai Subordinate CA 3 ,, VeriSign, Inc. ,, Thawte SGC CA ,, VeriSign Class 3 Secure Server CA - G2 ,,
The certificate won't show up on Firefox. I tried this several times, even deleting the profile, and it showed up once on the Firefox interface, but completely empty.
Anyways, that's only for a user, and I want to add them system-wide. Is there a system-wide database I can modify? How?
If there is no system-wide database I can modify, I can rely on a X start script (as
/etc/X11/Xsession.d/ ones, or a script called by the xdg autostart system on
/etc/xdg/autostart/) to modify the user profile at session start, but I need a solution that works. I can't even load certificates on the user profiles from the command line now!