Just after pressing send on this message, I found where Firefox can be
configured to trust enterprise root certificates. See this article:
Once configured, Firefox should trust the OS certificate store. But I
haven't gotten it to work. Yet.
On Mon, Mar 2, 2020 at 11:22 PM Nicholas DeMarco <ndemarco(a)practichem.com>
wrote:
Hello, Thanks to this group's help, I'm learning my way
through IPA's
certificate system.
I read Fraser's well written post on creating sub-CAs, and successfully
got everything to work. I then ran into the same problem Kevin Vasko hit in
this thread:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
It seems Debian-based Chrome and Firefox don't implicitly trust the OS
root certificate store.
For each Firefox profile (about:profiles), the NSS db is in
~/.mozilla/firefox/<profile>. The certs in this directory can be listed
certutil -d sql:/home/nick/.mozilla/firefox/4sar5x5s.default-release/ -L
On Ubuntu 18.04, after installing and configuring IPA client (#
ipa-client-install --mkhomedir), the IPA certificate is listed in the store.
Still, Firefox doesn't trust the IPA server or its trusted hosts. Why???
It's been established that Linux Firefox and Linux Chrome don't trust the
OS trusted certificate stores. It seems, with all that comes with
assumptions, that Firefox doesn't trust its own profile store, either.
Nick