From 7dd8e6b8458ea59926ca62a2b3955ef645b97104 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Thu, 29 Oct 2026 11:48:44 +0100 Subject: [PATCH 1/2] feat: improve Certificates examples --- .../docs/reference/policies/Certificates.mdx | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/src/content/docs/reference/policies/Certificates.mdx b/src/content/docs/reference/policies/Certificates.mdx index 1382025..cacb036 100644 --- a/src/content/docs/reference/policies/Certificates.mdx +++ b/src/content/docs/reference/policies/Certificates.mdx @@ -43,6 +43,39 @@ Install and manage certificates in Firefox. +### Trusting root certificates from the operating system + +On Windows and macOS, deploy your organization's root certificate to the operating system certificate store, for example with group policy or an MDM profile, and have Firefox trust it from there. +Firefox reads these certificates from the operating system each time it starts, so when you replace or remove a certificate in the operating system store, Firefox follows. +Certificates added with `Install` stay in each user's profile even after you remove them from the policy. +This example also locks the setting, so users can't turn it off: + +```json +{ + "policies": { + "Certificates": { + "ImportEnterpriseRoots": true + } + } +} +``` + +### Installing a root certificate on Linux + +This example uses a full path to a directory that only administrators can write to. +If you give only a filename, Firefox checks each user's `~/.mozilla/certificates` directory before the system directory, so a user's file with the same name would be installed instead. +Firefox installs the certificate into each user's profile, and doesn't remove it if you later take it out of the policy: + +```json +{ + "policies": { + "Certificates": { + "Install": ["/usr/lib/mozilla/certificates/example-root-ca.pem"] + } + } +} +``` + ## Windows (GPO) ``` From dc9584f681396e54fa4c2c4d2e5ae325837a8253 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Thu, 29 Oct 2026 11:56:01 +0100 Subject: [PATCH 2/2] feat: improve Certificates examples --- src/content/docs/reference/policies/Certificates.mdx | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/content/docs/reference/policies/Certificates.mdx b/src/content/docs/reference/policies/Certificates.mdx index cacb036..89b6f14 100644 --- a/src/content/docs/reference/policies/Certificates.mdx +++ b/src/content/docs/reference/policies/Certificates.mdx @@ -33,7 +33,7 @@ Install and manage certificates in Firefox. We do not support using `%USERPROFILE%` or other environment variables on Windows. If you are specifying the path in the policies.json file on Windows, you need to escape your backslashes (`\\`) which means that for UNC paths, you need to escape both (`\\\\`). - If you use group policy, you only need one backslash. + If you use Group Policy, you only need one backslash. Certificates are installed using the trust string `CT,CT,`. @@ -45,8 +45,10 @@ Install and manage certificates in Firefox. ### Trusting root certificates from the operating system -On Windows and macOS, deploy your organization's root certificate to the operating system certificate store, for example with group policy or an MDM profile, and have Firefox trust it from there. -Firefox reads these certificates from the operating system each time it starts, so when you replace or remove a certificate in the operating system store, Firefox follows. +On Windows and macOS, deploy your organization's root certificate to the operating system certificate store, for example with Group Policy or an MDM profile, and have Firefox trust it from there. +Firefox loads these certificates into memory from the operating system each time it starts, rather than adding them to the profile. +When you replace or remove a certificate in the operating system store, the change takes effect the next time Firefox starts. + Certificates added with `Install` stay in each user's profile even after you remove them from the policy. This example also locks the setting, so users can't turn it off: @@ -63,7 +65,7 @@ This example also locks the setting, so users can't turn it off: ### Installing a root certificate on Linux This example uses a full path to a directory that only administrators can write to. -If you give only a filename, Firefox checks each user's `~/.mozilla/certificates` directory before the system directory, so a user's file with the same name would be installed instead. +If you give only a filename, Firefox checks each user's `~/.mozilla/certificates` directory before the system certificate directory, so a user's file with the same name would be installed instead. Firefox installs the certificate into each user's profile, and doesn't remove it if you later take it out of the policy: ```json