Confirm, administrator
5,526
edits
Changes
m
→How To Override Default Root Certificate Settings
This page describes how to override the default root certificate settings in Mozilla products, including Firefox and Thunderbird.
See the [[CA:Root_Change_Process|Root Change Process]] if you are looking for instructions for changing default root certificate settings certificates in Mozilla products.
When distributing binary and source code versions of Firefox, Thunderbird, and other Mozilla-related software products the Mozilla Foundation and its wholly-owned subsidiary the Mozilla Corporation include with such software a default set of X.509v3 certificates for various Certification Authorities (CAs). The certificates included by default have their "trust bits" set for various purposes, so that the software in question can use the CA certificates to verify certificates for SSL servers, S/MIME email users, and digitally-signed code objects without having to ask users for further permission or information.
CAs apply to have their root certificates included by default in Mozilla products by following the [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA Certificate Policy] and applying for inclusion as per [[CA:How_to_apply|CA:How_to_apply]].
Users of Mozilla products may override the default root certificate settings by either deleting the root certificate or by changing a roots the trust bit settingsof a root certificate. The sections below describe how to make these changes, and how the software responds to such changes.
'''Important:''' If you change the trust bit of a root certificate, that change will be permanent (can only be changed again by you) and will not be affected by upgrading to newer versions of the software. On the other hand, if you delete a root certificate and if that root certificate is in the default root store, then the root certificate will be included again the next time you upgrade to a newer version of the software.
