[GH-ISSUE #11] Installing certs for Firefox/Chromium on Linux #8

New issue

Closed

opened 2026-02-25 22:32:21 +03:00 by kerem · 1 comment

kerem commented

2026-02-25 22:32:21 +03:00

Owner

Originally created by @fd0 on GitHub (Jun 28, 2018).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/11

Hi, while I don't have a use case for mkcert, I've just recently written a shell script which inserts a CA into all browser profiles for a user, and I thought I just leave some hints here:

For Firefox, the cert needs to be inserted into each NSS db in each profile directory within ~/.mozilla/firefox, using certutil. The code in truststore_firefox.go looks good already
For Chromium (and probably also Chrome), there's a central NSS db in ~/.pki/nssdb into which the certificate can be added via certutil, very similar to Firefox

That should do the trick for Linux for the most widely used browsers at least (which should cover like 90% of the use cases out there).

Adding the certificate to the system's trust store depends on the Linux distribution, it's a lot more complex. For Fedora, the browsers also trust certificates in the system-wide trust store in /etc, on Debian that's not the case: browsers just ignore all system ca certificates.

Originally created by @fd0 on GitHub (Jun 28, 2018). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/11 Hi, while I don't have a use case for `mkcert`, I've just recently written a shell script which inserts a CA into all browser profiles for a user, and I thought I just leave some hints here: * For Firefox, the cert needs to be inserted into each NSS db in each profile directory within `~/.mozilla/firefox`, using `certutil`. The code in `truststore_firefox.go` looks good already * For Chromium (and probably also Chrome), there's a central NSS db in `~/.pki/nssdb` into which the certificate can be added via `certutil`, very similar to Firefox That should do the trick for Linux for the most widely used browsers at least (which should cover like 90% of the use cases out there). Adding the certificate to the system's trust store depends on the Linux distribution, it's a lot more complex. For Fedora, the browsers also trust certificates in the system-wide trust store in `/etc`, on Debian that's not the case: browsers just ignore all system ca certificates.