How to trust a website only when there is manually imported certificate?
Hello,
how to trust a website only when there is manually imported certificate?
I disabled all CAs and want to set FF to: 1) trust (and connect) only to sites for which I have imported certificate 2) do NOT trust to any other certificate (even issued by CA with imported cert).
Even if I have the certificate in the "Servers" list, FF still complains :( Tried in FF 39, 41 and 42 (linux 64bit).
Many thanks
Gekozen oplossing
OK, thanks for your time.
The solution is: add the certificate exception in non-private firefox window. After restart, the cert is in cert_override.txt file in profile folder and Firefox connects to the server even if the root CA trust bits are disabled.
This is exactly the behavior I was looking for :)
Dit antwoord in context lezen 👍 0Alle antwoorden (6)
Hi, When you say FF still complains :( can you please provide a screenshot of the error, we will need some more info to help.
For reference:
Note, real question might be was config entries need to be disabled.
Hi, thanks for reply!
By "FF still complains" I mean standard error page "This Connection is Untrusted" with, or without, "Add exception" button.
To give you a real example:
I have current certificate for support.mozilla.org (SHA-256 = 2F:D5:63:1B:B0:CF:A0:1E:86:B3:F2:78:F1:0B:00:6F:5A:4B:E2:58:50:10:5E:0B:A3:A8:6E:4B:C4:5F:9F:1B) manually imported in Preferences->Advanced->Certificates->View Certificates->Servers list. I also have the root CA for this certificate (DigiCert High Assurance EV Root CA) distrusted (all 3 bits off).
But when I connect to the https://support.mozilla.org, I get the Untrusted Connection error page.
I want to set that the *manually imported* certificate (identified by checksums etc) would allow the connection even if his root CA is distrusted.
Any ideas how to do set it?
Thanks!
Only if trust bit(s) are set then you can trust a website. You would normally have the trust bits set on a built-in root certificate. I assume that you would have to import the certificate under the authorities tab and set its trust bits to trust websites.
I don't know for what reason you have distrusted all built-in root certificates, but doing that doesn't make this easier.
> I don't know for what reason you have distrusted all built-in root certificates, but doing that doesn't make this easier.
I explained this at the beginning. I want to trust only to manually imported certificates, not to any certificate from the root CAs. So the "set root CA's trust bits on" is not a solution. I hope it is clearer now.
Yes, both senarios are recognized as mis-issued in Mozilla's CA certificate policy. Mentioned here
Gekozen oplossing
OK, thanks for your time.
The solution is: add the certificate exception in non-private firefox window. After restart, the cert is in cert_override.txt file in profile folder and Firefox connects to the server even if the root CA trust bits are disabled.
This is exactly the behavior I was looking for :)