Recently, the CAcert root certificates have been removed from Debian (more precisely, from the ca-certificates package). Since I want to keep them, I backed up the directory


containing two .crt files before the upgrade and copied it to


afterwards. Then I ran update-ca-certificates:

# update-ca-certificates 
Updating certificates in /etc/ssl/certs... 2 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Adding debian:cacert.org_class3.pem
Adding debian:cacert.org_root.pem

It looks like all went well. However, Firefox (Iceweasel) still refuses certificates signed by CAcert as untrusted.

Is there anything I missed? Do I have to do something special to make Firefox actually re-read the system certificates?


Firefox works after a clean installation. If certificate database in cert8.db is deleted, it is regenerated on next Firefox start. This strongly suggests that there is a system-wide default storage of CA certs.

Firefox's source code shows that built-in CA certs are in fact hard-coded into firefox executable. They reside in security/nss/lib/ckfw/builtins/certdata.txt

So there is no way to install a certificate system-wide. Beware that patching source code may bring up issues with intellectual property rights.

  • 2
    As for the last point, Firefox is free software, so there is no issue with modifying the source. Whether it is a good solution is another topic. – isarandi Aug 10 '18 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.