Check Firefox enterprise root trust before replacing a certificate

Check operating-system trust and enterprise policy when Firefox alone rejects an internal service certificate.

Source facts

Mozilla documents that Firefox on Windows and macOS can use third-party certificate authorities installed in the operating system’s trust store, with this behavior enabled by default. The security.enterprise_roots.enabled preference controls it, and enterprise policy can enable ImportEnterpriseRoots. On Windows, imported operating-system roots may not appear in Firefox’s own certificate manager. Mozilla documents Linux deployment through separate methods.

Source: Mozilla — Set up Certificate Authorities in Firefox.

Applicability

This guide addresses managed Windows and macOS clients using a private CA. Verify the deployed Firefox build, effective policy, and certificate chain before changing trust.

DSE recommendation

DSE recommends comparing the failing client with a working managed client and recording the actual issuer, certificate names, validity dates, OS trust, and Firefox policy. Validate the CA certificate through the organization’s established certificate process. Investigate whether policy or client configuration explains the difference before replacing an otherwise appropriate server certificate. Keep trust distribution centralized where practical, and assign an owner to remove obsolete roots. Do not import an unfamiliar certificate merely because an error page offers it.

Verification

After the approved change, verify the intended service in the actual managed browser profile. Check that name and validity errors remain detectable on an isolated test endpoint. Record effective policy and the trusted CA’s public fingerprint without collecting private keys.

Official reference

Mozilla — Set up Certificate Authorities in Firefox. Reviewed October 14, 2026.