Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way do deploy remotely new CA certificates to Firefox installs?

In other words, has anything changed since this question was answered Installing a CA certificate on multiple Windows machines (IE/Firefox)

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

With certutil from NSS Tools [1] you can administer the certificate databases used by softwares like Firefox and Thunderbird [2]:

certutil.exe -A -n <cert name> -t <trust> -i <cert filepath> -d <firefox/thunderbird profile dirpath)

Example that adds "mycompany.pem" certificate file as "mycompany" into Firefox profile and set to trusts it as a CA that can issue client certificates for SSL, e-mail and signing (_C,C,C) as well as server certificates for SSL (T_,_,_). Should be done when software is not running.

certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "C:\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

# Remote profile accessed via administrative share
certutil.exe -A -n "mycompany" -t "CT,C,C" -i "mycompany.pem" -d "\\computer\c$\Users\johndoe\AppData\Roaming\Mozilla\Firefox\Profiles\someprofile.abcdef"

You could also run the first command via PsTools's PsExec.

NSS Tools sources can be grabbed from https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/ (some Windows binaries can be found on the Internet but given the security nature: it's better to compile it yourself)

[1]: Network Security Services: https://developer.mozilla.org/docs/NSS/tools/NSS_Tools_certutil

[2]: They are using a Netscape Communicator database with files cert8.db and key3.db.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.