1927623 - Make ImportEnterpriseRoots work in Linux

Status: RESOLVED DUPLICATE of bug 1654000

(Core :: Widget: Gtk, enhancement)

Description

[Phillip]

Steps to reproduce:

Attempted to configure Firefox with the below policy and discovered that it doesn't work in Linux.

{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    }
  }
}

Actual results:

This is apparently by design as documented in https://mozilla.github.io/policy-templates/#certificates--importenterpriseroots and https://bugzilla.mozilla.org/show_bug.cgi?id=1600509

Expected results:

As documented in multiple places, the policy ImportEnterpriseRoots is not implemented for Linux.

As an Enterprise Admin, this is frustrating because we already manage the system trust store, and want Firefox to trust the certificates we install for the system.

We realize that some distros (Fedora) package Firefox with p11-kit to do this, but we would prefer to have a standardized way across all distros that is included in Firefox, not by each individual distro.

I'm submitting this as a dedicated issue to discuss why Linux wasn't included and to request that the decision be revisited.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[Martin Stránský [:stransky] (ni? me)]

Mike, any idea here?
Thanks.

Comment 3

[Mike Kaply [:mkaply]]

Is there a standard certificate store on all versions of Linux that has the same API?

when we created this, there wasn't.

Checking with Dana.

Comment 4

[Dana Keeler (she/her) [:keeler]]

I'm not aware of a standard that specifies it, although there are conventional places we can look for certificates to trust.

Comment 5

[Dana Keeler (she/her) [:keeler]]

(In reply to Phillip from comment #0)

we already manage the system trust store

Can you say more about this? What is "the system trust store" in your opinion?