I need to set up an IIS webserver that will be accessed by a small, finite number of users. I was considering using a self-signed certificate only, and manually installing it on the user's systems.
So I generated the certificate with IIS tools, installed it on the webserver, and exported it in a .cer file. Adding it the Trusted Authorities in windows settings works well with Internet Explorer : it removes the unsecure warning.
In firefox, I can't make it work. Enabling the security.enterprise_roots.enabled option doesn't help. In Firefox Certificate settings, I can't import it to the Authorities panel, I get an error message :
This is not a certificate authority certificate, so it can't be imported into the certificate authority list
What can I do? I don't want to add an exception in Firefox, as it permanently disables any certificate checking on the URL, which means any man in the middle attack becomes straightforward. I want the user being blocked from accessing the website if the certificate changes on the server.