0

Assume a corporate computer that has intrinsic software installed. It's a mitm setup that replaces the web page's certificate to one signed with a intrinsic software vendor's certificate that is trusted by the system and thus is trusted by web browsers.

But Firefox is able to tell if the certificate is signed by a trusted issuer or not but it does not warn the user, one must click the lock icon next to the address to get to know that.

How can I make Firefox scream that the issuer is not recognized by Firefox (yet still trusted due to its presence in OS)?

5
  • 2
    As far as I am aware it is not possible to make browsers differentiate certificates based on their origin (browser internal or OS certificate store).
    – fleitner
    Feb 6, 2023 at 12:55
  • Regarding usability questions, what you want Firefox to display or not, please ask Mozilla developers, such question are off-topic on Security SE. Regarding the difference between Firefox own certificates and OS certificates, see the answer below.
    – mentallurg
    Feb 6, 2023 at 13:12
  • "How can I make Firefox scream that the issuer is not recognized by Firefox (yet still trusted due to its presence in OS)?" - it does this already. That's why in corporate MITM scenarios the MITM CA is not only put into the OS trust store but also in various other trust stores, like the one from Firefox. Feb 6, 2023 at 14:15
  • To make Firefox warn about unknown certificate issuer: remove root certificates for all unknown certificate issuers from the Firefox trust store.
    – mti2935
    Feb 6, 2023 at 20:47
  • @mti2935: and/or (in this case probably or) turn off the 'enterprise roots' option Feb 7, 2023 at 0:45

3 Answers 3

0

Mozilla considers root CA certificates as very important, wants to be able to to set policies and take actions. See Why Does Mozilla Maintain Our Own Root Certificate Store?:

“root” certificates that we use as “trust anchors” ... Despite the effort involved, Mozilla is committed to maintaining our own root store because doing so is vital to the security of our products and the web in general. It gives us the ability to set policies, determine which CAs meet them, and to take action when a CA fails to do so.

That's why it maintains its own Root Certificate Store.

See further details here:

Mozilla maintains an own certificate store since some years. Recently also Chromium has decided to do that. See Announcing the Launch of the Chrome Root Program.

1
0

Firefox doesn't distinguish between built-in certificates and user-installed ones. You get no warning, period.

If you want this feature in the browser you could consider two options 1) opening a feature request at their bugzilla 2) writing a patch and compiling your own version of Firefox which does precisely that.

1
  • or 3) Create an extension for that.
    – ThoriumBR
    Mar 8, 2023 at 23:28
0

Firefox settings → Privacy & Security → View certificates → Authorities

Select the vendor CA used by the mitm solution and press "Delete or Distrust" button

I expect this will do the RIght Thing™ for certificates that were automatically imported from the system trust store. In case it reimports them s trusted (thus defeating your disabling), you may need to change in about:config the value security.enterprise_roots.enabled to false (and delete them again). You should do some tests, restarting Firefox inbetween.

Note that if the network is configured to intercept everything, you will get a certificate error for every https page, since it will be mitm every website.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .