Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory


containing two .crt files before the upgrade and copied it to


afterwards. Then I ran update-ca-certificates:

# update-ca-certificates 
Updating certificates in /etc/ssl/certs... 2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:cacert.org_class3.pem
Adding debian:cacert.org_root.pem

It looks like all went well. However, Firefox (Iceweasel) still refuses certificates signed by CAcert as untrusted.

Is there anything I missed? Do I have to do something special to make Firefox actually re-read the system certificates?

share|improve this question
I would say ==> cyberciti.biz/faq/firefox-adding-trusted-ca – Kiwy Apr 3 '14 at 12:00
Sure. However, I'd like to add it as a system-wide setting. The mechanics for this obviously exist; I'm just not sure how to use it properly. – user3426575 Apr 3 '14 at 12:04
As far as I know firefox does not use the trusted keystore of the sstem but it's own trusted keystore. but it seems possible with this article wiki.mozilla.org/NSS_Shared_DB_Howto – Kiwy Apr 3 '14 at 12:05

Firefox works after a clean installation. If certificate database in cert8.db is deleted, it is regenerated on next Firefox start. This strongly suggests that there is a system-wide default storage of CA certs.

Firefox's source code shows that built-in CA certs are in fact hard-coded into firefox executable. They reside in security/nss/lib/ckfw/builtins/certdata.txt

So there is no way to install a certificate system-wide. Beware that patching source code may bring up issues with intellectual property rights.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.