# Check Firefox enterprise root trust before replacing a certificate

> Check operating-system trust and enterprise policy when Firefox alone rejects an internal service certificate.

- Canonical URL: https://update.dsesecurity.com/updates/firefox-enterprise-private-ca-trust-diagnostics/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T00:43:29+00:00
- Modified: 2026-10-15T00:44:33+00:00
- Last reviewed by DSE: 2026-10-14
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Check operating-system trust and enterprise policy when Firefox alone rejects an internal service certificate.

## Potentially affected

This guide addresses managed Windows and macOS clients using a private CA. Verify the deployed Firefox build, effective policy, and certificate chain before changing trust.

## DSE recommendation

DSE recommends comparing the failing client with a working managed client and recording the actual issuer, certificate names, validity dates, OS trust, and Firefox policy.

## Article

Check operating-system trust and enterprise policy when Firefox alone rejects an internal service certificate.

## Source facts

Mozilla documents that Firefox on Windows and macOS can use third-party certificate authorities installed in the operating system’s trust store, with this behavior enabled by default. The security.enterprise_roots.enabled preference controls it, and enterprise policy can enable ImportEnterpriseRoots. On Windows, imported operating-system roots may not appear in Firefox’s own certificate manager. Mozilla documents Linux deployment through separate methods.

Source: [Mozilla — Set up Certificate Authorities in Firefox](https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox).

## Applicability

This guide addresses managed Windows and macOS clients using a private CA. Verify the deployed Firefox build, effective policy, and certificate chain before changing trust.

## DSE recommendation

DSE recommends comparing the failing client with a working managed client and recording the actual issuer, certificate names, validity dates, OS trust, and Firefox policy. Validate the CA certificate through the organization’s established certificate process. Investigate whether policy or client configuration explains the difference before replacing an otherwise appropriate server certificate. Keep trust distribution centralized where practical, and assign an owner to remove obsolete roots. Do not import an unfamiliar certificate merely because an error page offers it.

## Verification

After the approved change, verify the intended service in the actual managed browser profile. Check that name and validity errors remain detectable on an isolated test endpoint. Record effective policy and the trusted CA’s public fingerprint without collecting private keys.

## Official reference

[Mozilla — Set up Certificate Authorities in Firefox](https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox). Reviewed October 14, 2026.

## Primary reference

- Name: Mozilla — Set up Certificate Authorities in Firefox
- Authority: support.mozilla.org
- URL: https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check Firefox enterprise root trust before replacing a certificate,” DSE Security, https://update.dsesecurity.com/updates/firefox-enterprise-private-ca-trust-diagnostics/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.