Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way do deploy remotely new CA certificates to Firefox installs?

In other words, has anything changed since this question was answered Installing a CA certificate on multiple Windows machines (IE/Firefox)

share|improve this question
up vote 1 down vote accepted

With certutil from NSS Tools [1] you can administer the certificate databases used by softwares like Firefox and Thunderbird [2]:

certutil.exe -A -n <cert name> -t <trust> -i <cert filepath> -d <firefox/thunderbird profile dirpath)

Example that adds "mycompany.pem" certificate file as "mycompany" into Firefox profile and set to trusts it as a CA that can issue client certificates for SSL, e-mail and signing (_C,C,C) as well as server certificates for SSL (T_,_,_). Should be done when software is not running.

certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "C:\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

# Remote profile accessed via administrative share
certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "\\computer\c$\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

You could also run the first command via PsTools's PsExec.

NSS Tools sources can be grabbed from (some Windows binaries can be found on the Internet but given the security nature: it's better to compile it yourself)

[1]: Network Security Services:

[2]: They are using a Netscape Communicator database with files cert8.db and key3.db.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.