CA/Changing Trust Settings: Difference between revisions

From MozillaWiki
< CA
Jump to navigation Jump to search
m (Protected "CA/Changing Trust Settings" ([Edit=Allow confirmed users only] (indefinite) [Move=Allow confirmed users only] (indefinite)))
 
(44 intermediate revisions by 6 users not shown)
Line 1: Line 1:
= How To Override Default Root Certificate Settings =
This page describes how to change the default root certificate trust settings in Mozilla products, including Firefox and Thunderbird.


This page describes how to override the default root certificate settings in Mozilla products, including Firefox and Thunderbird.
If you are seeing "Your connection is not secure" errors and you don't know why, visit [https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean this support page].


See the [[CA:Root_Change_Process|Root Change Process]] if you are looking for instructions for changing default root certificates in Mozilla products.
Some browsers only display the root certificates that the user has actually used, and dynamically download new ones on demand. However, Mozilla believes it is important for users to know the root certificates that could be used, so the full set of certificates is always shown. This also allows you to edit the trust bits for any root certificates that you do not want to use.


When distributing binary and source code versions of Firefox, Thunderbird, and other Mozilla-related software products the Mozilla Foundation and its wholly-owned subsidiary the Mozilla Corporation include with such software a default set of X.509v3 certificates for various Certification Authorities (CAs). The certificates included by default have their "trust bits" set for various purposes, so that the software in question can use the CA certificates to verify certificates for SSL servers, S/MIME email users, and digitally-signed code objects without having to ask users for further permission or information.
== Important Warnings ==


CAs apply to have their root certificates included by default in Mozilla products by following the [http://www.mozilla.org/projects/security/certs/policy/ Mozilla CA Certificate Policy] and applying for inclusion as per [[CA:How_to_apply|CA:How_to_apply]].
Following instructions on this page may negatively affect your security and/or your browsing experience.


Users of Mozilla products may override the default root certificate settings by either deleting the root certificate or by changing the trust bit settings of a root certificate. The sections below describe how to make these changes, and how the software responds to such changes.
If you turn off the websites trust bit of a commonly used root certificate, you may get an "Your connection is not secure" error when you navigate to one or more popular websites. Bypassing such errors can be a security risk unless you know what you are doing. Therefore, it is strongly recommended that you '''note which root certificate you modify''', so that you can turn the trust bit back on if the change negatively impacts your browsing experience.


'''Important:''' If you change the trust bit of a root certificate, that change will be permanent (can only be changed again by you) and will not be affected by upgrading to newer versions of the software. On the other hand, if you delete a root certificate and if that root certificate is in the default root store, then the root certificate will be included again the next time you upgrade to a newer version of the software.
If you change the trust bits of a root certificate or add or delete roots, that change will be will '''not''' be affected by upgrading to newer versions of the software. It can only be changed again by you.


== Changing Root Certificate Trust Bit Settings ==
Deleting a root certificate that is in the default root store is equivalent to turning off all of the trust bits for that root. Therefore, '''even though the root certificate will re-appear in the Certificate Manager''', it will be treated as though you changed the trust bits of that root certificate to turn them all off.


Root certificates that are included by default have their "trust bits" set for various purposes, so that the software in question can use the CA certificates to verify certificates for SSL servers, S/MIME email users, and digitally-signed code objects without having to ask users for further permission or information.
== Trusting an Additional Root Certificate ==


The following describes how to change these settings in your installation of Firefox and Thunderbird.
The following describes how to manually import a root certificate into your installation of Firefox or other Mozilla products.


'''Important:''' This change will be permanent, such that it can only be changed again by you. This change will not be affected by upgrading to newer versions of Mozilla software.
[[Firefox]]
# Open the '''Options/Preferences''' window:
# Open the '''Options/Preferences''' window:
#* On Windows: Pull down the '''Tools''' menu and select '''Options…'''
#* On Windows: Pull down the '''Tools''' menu and select '''Options…'''
#* On Mac: Pull down the '''Firefox''' menu and select '''Preferences...'''
#* On Mac: Pull down the '''Firefox''' menu and select '''Preferences...'''
# Select '''Advanced'''
#* On Linux: Pull down the '''Edit''' menu and select '''Preferences'''
# Select '''Encryption'''
# Select '''Privacy & Security'''
# Click on '''View Certificates''' to open the '''Certificate Manager'''
# Scroll down to the '''Certificates''' section
# Select '''Authorities'''
# Click on '''View Certificates..''' to open the '''Certificate Manager'''
# Select the Root Certificate that you want to change
# Select '''Authorities''' tab
# Click on '''Edit...'''
#* Note: The root certificates with "Builtin Object Token" as the Security Device are the root certificates that are included by default in Mozilla products.
# Click on '''Import...'''
# Select the file of the Root Certificate that you want to import
# Select/Unselect the check-boxes indicating the trust bits, then click on '''OK'''
# Select/Unselect the check-boxes indicating the trust bits, then click on '''OK'''
# Click on '''OK''' in the '''Certificate Manager'''
# Click on '''OK''' in the '''Certificate Manager'''
# Close the '''Options/Preferences''' window
# Close the '''Options/Preferences''' tab
 
== Changing Root Certificate Trust Settings ==


To change the trust settings for root certificates in your installation of Firefox or other Mozilla products, follow the instructions above, except when you are in the Authorities tab of the Certificate Manager:


[[Thunderbird]]
# Open the '''Options/Preferences''' window:
#* On Windows: Pull down the '''Tools''' menu and select '''Options…'''
#* On Mac: Pull down the '''Thunderbird''' menu and select '''Preferences...'''
# Select '''Advanced'''
# Select '''Certificates'''
# Click on '''View Certificates''' to open the '''Certificate Manager'''
# Select '''Authorities'''
# Select the Root Certificate that you want to change
# Select the Root Certificate that you want to change
# Click on '''Edit...'''
# Click on '''Edit Trust...'''
# Select/Unselect the check-boxes indicating the trust bits, then click on '''OK'''
# Select/Unselect the check-boxes indicating the trust bits, then click on '''OK'''
# Click on '''OK''' in the '''Certificate Manager'''
# Close the '''Options/Preferences''' window


== Deleting a Root Certificate ==
Close and restart Firefox
 
== Deleting a Root Certificate ==
 
To delete a root certificate from your current instance of Firefox or other Mozilla products, follow the instructions above, except when you are in the Authorities tab of the Certificate Manager:
 
# Select the Root Certificate that you want to delete
# Click on '''Delete or Distrust...'''
# If you are sure you want to delete that root certificate, click on '''OK'''


Firefox On Windows:
Close and restart Firefox


Thunderbird On Windows:
== Restoring the Default Trust Settings for All Root Certificates ==
* [https://support.mozilla.org/en-US/kb/refresh-firefox-reset-add-ons-and-settings Refresh Firefox button] -- Recommended way to restore the security certificate settings.
* [https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean#w_corrupted-certificate-store Manually restore the security certificate settings] -- only perform as last resort.


Firefox On Mac:
== Restoring the Default Trust Settings for a Single Root Certificate ==


Thunderbird On Mac:
If you want the cert to again respect any updates Mozilla makes to the default root store, this is extremely difficult. It is far easier to reset the entire store using the instructions above.


'''Important:''' This change may be overridden when you upgrade to the next version of the Mozilla software. If the deleted root certificate is still in Mozilla's default root store, then the root certificate will be included again the next time you upgrade to a newer version of the software.
== Deeply Geeky Certificate Database Information ==


== How Mozilla Products Respond to User Changes of Root Certificates ==
=== How Mozilla Products Respond to User Changes of Root Certificates ===


The following explains how Mozilla products behave when users change or delete root certificates.
The following explains how Mozilla products behave when users change or delete root certificates.
Line 74: Line 76:


# Your certificate database, which is kept in a file on disk that you can alter.  It starts out empty.  Any root certificates it contains are there because of actions that you have taken, such as downloading or importing roots, or editing trust flags.  As a rule, an update to your Mozilla installation of a Mozilla product will not change the contents of this database.  (Rarely, it may change the FORMAT of the database, but not the content.)
# Your certificate database, which is kept in a file on disk that you can alter.  It starts out empty.  Any root certificates it contains are there because of actions that you have taken, such as downloading or importing roots, or editing trust flags.  As a rule, an update to your Mozilla installation of a Mozilla product will not change the contents of this database.  (Rarely, it may change the FORMAT of the database, but not the content.)
#2 Mozilla's trusted root list, kept in a read-only shared library which is one of the files that gets updated whenever your product's executable files get updated.
# Mozilla's built-in root list, kept in a read-only shared library which is one of the files that gets updated whenever your product's executable files get updated.


Both of these stores of certificates may contain certificates and trust flags.
Both of these stores of certificates may contain certificates and trust flags.
Line 80: Line 82:
When NSS goes looking for a stored certificate, or trust flags for a stored certificate, it first looks in your certificate database.  If it finds the certificate there, it stops.  It uses whatever trust flags are there in that database with that certificate.
When NSS goes looking for a stored certificate, or trust flags for a stored certificate, it first looks in your certificate database.  If it finds the certificate there, it stops.  It uses whatever trust flags are there in that database with that certificate.


If it does NOT find the certificate it wants in that database, it looks in Mozilla's trusted root list.  If it finds the cert there, then it uses the cert and trust flags it finds there.  It does not copy the cert and flags from the root list into your database.  It just uses them where and as they are.
If it does NOT find the certificate it wants in that database, it looks in Mozilla's built-in root list.  If it finds the cert there, then it uses the cert and trust flags it finds there.  It does not copy the cert and flags from the built-in root list into your database.  It just uses them where and as they are.
 
When you use your product's certificate manager to edit the trust flags on a certificate, the cert manager first looks for the cert in your database, and if it's there, then that copy gets edited.  If it's not there, then cert manager looks for a copy in the built-in root list, and if found, copies it and its flags into your data base, and then edits it there. (After all, it cannot edit the copy in the built-in list, because that copy is read-only.)  After that, that cert will remain in your database, and each time that the product goes looking for it, it will find it in your database, not in the built-in list.
 
If you delete a cert in your database that is also in the built-in list, it may appear to be completely gone, until you restart your program, at which point it will reappear, because it never left the built-in root list. However, the trust bits will be turned off for the root.
 
If you edit the trust on a cert in the root list, taking away (say) one of the 2 trust flags, but leaving the other one, then that cert and the single trust bit will be in your cert DB.  After that, if Mozilla removes that cert completely from the built-in list, it will remain in your cert DB with the remaining trust flag.  Mozilla's changes to the built-in list never affect your databases.  Your databases contain what YOU put there. They're your changes, your responsibility.
 
In conclusion, the changes Mozilla makes to Mozilla's read-only list of built-in root certs affect only those certs that do not also appear in your cert DB.  When you cause copies of any of those certs to appear in your cert DB, then you have taken control of the trust for those copies, and changes made by Mozilla thereafter to those certs will not affect you.
 
=== Restoring the Default Trust Bits for a Single Built-In Root Certificate ===
 
If you have edited the trust bits of a built-in root certificate, causing it to be copied to your personal database, you may wish to delete the copy from your database so that the default trust bits are again used.  (Simply editing the trust bits to match the defaults would not give you the benefit of any updates Mozilla may later make to the defaults.)  There is currently no UI to do this ({{bug|558222}}), but you can use the NSS <code>certutil</code> command-line tool.  <code>certutil</code> does not ship with Mozilla products, and [https://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/94d05b904280b6ed NSS itself does not have official binary releases at this time], but you can build <code>certutil</code> from source, or your OS distribution may include it (Fedora: <code>nss-tools</code>, Debian/Ubuntu: <code>libnss3-tools</code>).
 
To delete a certificate from your personal database:
 
# Note the Certificate Name as shown in the Certificate Manager.
# [https://support.mozilla.com/en-US/kb/profiles#w_how-do-i-find-my-profile Locate your profile].
# Shut down the Mozilla application.
# Run: <syntaxhighlight lang="bash"># for older Mozilla products, leave off the `sql:` part
certutil -d sql:PROFILE_DIR -D -n CERT_NAME</syntaxhighlight> substituting <tt>PROFILE_DIR</tt> with the path of your profile directory and <tt>CERT_NAME</tt> with the certificate name.
# Restart the Mozilla application.
 
=== Listing All Non-Default Root Certificate Settings ===
 
There is currently no UI to list all built-in root certificates for which you have overridden the default trust settings ({{bug|545498}}).  However, you can use the <code>certutil</code> tool described in the previous section to list all the certificates in your personal database, which includes built-in root certificates whose trust you have changed along with added root certificates and many other kinds of certificates.
 
Run this command (doing it while the Mozilla application is running is probably unsupported but does not seem to cause problems in practice):
 
<syntaxhighlight lang="bash">
# for older Mozilla products, leave off the 'sql:' part
certutil -d sql:PROFILE_DIR -L
</syntaxhighlight>


When you use your product's certificate manager to edit the trust flags on a certificate, the cert manager first looks for the cert in your database, and if it's there, then that copy gets edited.  If it's not there, then cert manager looks for a copy in the trusted cert list, and if found, copies it and its flags into your data base, and then edits it there. (After all, it cannot edit the copy in Mozilla's list, because that copy is read-only.)  After that, that cert will remain in your database, and each time that the product goes looking for it, it will find it in your database, not in the trusted list.
where <tt>PROFILE_DIR</tt> is the path to your profile as noted above.


If you delete a cert in your database, one that is also in the trusted list, it may appear to be completely gone, until you restart your program, at which point it will reappear, because it never left the trusted root list.  It may reappear in the trusted root list with the trust flags from that list.  That's why we tell people that if they want to get rid of a root, the thing to do is NOT to delete it, but rather is to take away all its trust.  (The behavior when a cert is deleted has changed a few times over the years.)
Root certificates will have trust fields of <code>c</code>, indicating a disabled trust bit, or <code>CT</code> or <code>C</code>, indicating an enabled trust bit.  For example:


If you edit the trust on a cert in the root list, taking away (say) one of the 3 trust flags, but leaving the other two, then that cert and the two trust bits will be in your cert DB.  After that, if Mozilla removes that cert completely from Mozilla's trust list, it will remain in your cert DB with those two trust flags.  Mozilla's changes to the default trust list never affect your databases.  Your databases contain what YOU put there. They're your changes, your responsibility.
<pre>
Certificate Nickname                                        Trust Attributes
                                                            SSL,S/MIME,JAR/XPI


In conclusion, the changes Mozilla makes to Mozilla's read-only list of trusted root certs affect only those certs that do not also appear in your cert DB.  When you cause copies of any of those certs to appear in your cert DB, then you have taken control of the trust for those copies, and changes made by Mozilla thereafter to those certs will not affect you.
My Favorite CA                                              CT,c,c
Wiretaps R Us CA                                            c,c,c
</pre>

Latest revision as of 12:00, 14 December 2024

This page describes how to change the default root certificate trust settings in Mozilla products, including Firefox and Thunderbird.

If you are seeing "Your connection is not secure" errors and you don't know why, visit this support page.

Some browsers only display the root certificates that the user has actually used, and dynamically download new ones on demand. However, Mozilla believes it is important for users to know the root certificates that could be used, so the full set of certificates is always shown. This also allows you to edit the trust bits for any root certificates that you do not want to use.

Important Warnings

Following instructions on this page may negatively affect your security and/or your browsing experience.

If you turn off the websites trust bit of a commonly used root certificate, you may get an "Your connection is not secure" error when you navigate to one or more popular websites. Bypassing such errors can be a security risk unless you know what you are doing. Therefore, it is strongly recommended that you note which root certificate you modify, so that you can turn the trust bit back on if the change negatively impacts your browsing experience.

If you change the trust bits of a root certificate or add or delete roots, that change will be will not be affected by upgrading to newer versions of the software. It can only be changed again by you.

Deleting a root certificate that is in the default root store is equivalent to turning off all of the trust bits for that root. Therefore, even though the root certificate will re-appear in the Certificate Manager, it will be treated as though you changed the trust bits of that root certificate to turn them all off.

Trusting an Additional Root Certificate

The following describes how to manually import a root certificate into your installation of Firefox or other Mozilla products.

  1. Open the Options/Preferences window:
    • On Windows: Pull down the Tools menu and select Options…
    • On Mac: Pull down the Firefox menu and select Preferences...
    • On Linux: Pull down the Edit menu and select Preferences
  2. Select Privacy & Security
  3. Scroll down to the Certificates section
  4. Click on View Certificates.. to open the Certificate Manager
  5. Select Authorities tab
    • Note: The root certificates with "Builtin Object Token" as the Security Device are the root certificates that are included by default in Mozilla products.
  6. Click on Import...
  7. Select the file of the Root Certificate that you want to import
  8. Select/Unselect the check-boxes indicating the trust bits, then click on OK
  9. Click on OK in the Certificate Manager
  10. Close the Options/Preferences tab

Changing Root Certificate Trust Settings

To change the trust settings for root certificates in your installation of Firefox or other Mozilla products, follow the instructions above, except when you are in the Authorities tab of the Certificate Manager:

  1. Select the Root Certificate that you want to change
  2. Click on Edit Trust...
  3. Select/Unselect the check-boxes indicating the trust bits, then click on OK

Close and restart Firefox

Deleting a Root Certificate

To delete a root certificate from your current instance of Firefox or other Mozilla products, follow the instructions above, except when you are in the Authorities tab of the Certificate Manager:

  1. Select the Root Certificate that you want to delete
  2. Click on Delete or Distrust...
  3. If you are sure you want to delete that root certificate, click on OK

Close and restart Firefox

Restoring the Default Trust Settings for All Root Certificates

Restoring the Default Trust Settings for a Single Root Certificate

If you want the cert to again respect any updates Mozilla makes to the default root store, this is extremely difficult. It is far easier to reset the entire store using the instructions above.

Deeply Geeky Certificate Database Information

How Mozilla Products Respond to User Changes of Root Certificates

The following explains how Mozilla products behave when users change or delete root certificates.

For simplicity, the following assumes the basic and most common configuration, in which you have only the software distributed by Mozilla and do not have any additional PKCS#11 modules (with or without any additional hardware) installed that may be capable of storing additional certificates. The model with them is slightly more complicated than the one described here.

Network Security Services (NSS) is capable of accessing certificates that have been stored in a number of places, all accessible through the PKCS#11 API. The two places of greatest interest are

  1. Your certificate database, which is kept in a file on disk that you can alter. It starts out empty. Any root certificates it contains are there because of actions that you have taken, such as downloading or importing roots, or editing trust flags. As a rule, an update to your Mozilla installation of a Mozilla product will not change the contents of this database. (Rarely, it may change the FORMAT of the database, but not the content.)
  2. Mozilla's built-in root list, kept in a read-only shared library which is one of the files that gets updated whenever your product's executable files get updated.

Both of these stores of certificates may contain certificates and trust flags.

When NSS goes looking for a stored certificate, or trust flags for a stored certificate, it first looks in your certificate database. If it finds the certificate there, it stops. It uses whatever trust flags are there in that database with that certificate.

If it does NOT find the certificate it wants in that database, it looks in Mozilla's built-in root list. If it finds the cert there, then it uses the cert and trust flags it finds there. It does not copy the cert and flags from the built-in root list into your database. It just uses them where and as they are.

When you use your product's certificate manager to edit the trust flags on a certificate, the cert manager first looks for the cert in your database, and if it's there, then that copy gets edited. If it's not there, then cert manager looks for a copy in the built-in root list, and if found, copies it and its flags into your data base, and then edits it there. (After all, it cannot edit the copy in the built-in list, because that copy is read-only.) After that, that cert will remain in your database, and each time that the product goes looking for it, it will find it in your database, not in the built-in list.

If you delete a cert in your database that is also in the built-in list, it may appear to be completely gone, until you restart your program, at which point it will reappear, because it never left the built-in root list. However, the trust bits will be turned off for the root.

If you edit the trust on a cert in the root list, taking away (say) one of the 2 trust flags, but leaving the other one, then that cert and the single trust bit will be in your cert DB. After that, if Mozilla removes that cert completely from the built-in list, it will remain in your cert DB with the remaining trust flag. Mozilla's changes to the built-in list never affect your databases. Your databases contain what YOU put there. They're your changes, your responsibility.

In conclusion, the changes Mozilla makes to Mozilla's read-only list of built-in root certs affect only those certs that do not also appear in your cert DB. When you cause copies of any of those certs to appear in your cert DB, then you have taken control of the trust for those copies, and changes made by Mozilla thereafter to those certs will not affect you.

Restoring the Default Trust Bits for a Single Built-In Root Certificate

If you have edited the trust bits of a built-in root certificate, causing it to be copied to your personal database, you may wish to delete the copy from your database so that the default trust bits are again used. (Simply editing the trust bits to match the defaults would not give you the benefit of any updates Mozilla may later make to the defaults.) There is currently no UI to do this (bug 558222), but you can use the NSS certutil command-line tool. certutil does not ship with Mozilla products, and NSS itself does not have official binary releases at this time, but you can build certutil from source, or your OS distribution may include it (Fedora: nss-tools, Debian/Ubuntu: libnss3-tools).

To delete a certificate from your personal database:

  1. Note the Certificate Name as shown in the Certificate Manager.
  2. Locate your profile.
  3. Shut down the Mozilla application.
  4. Run: 
    # for older Mozilla products, leave off the `sql:` part
certutil -d sql:PROFILE_DIR -D -n CERT_NAME
    substituting PROFILE_DIR with the path of your profile directory and CERT_NAME with the certificate name.
  5. Restart the Mozilla application.

Listing All Non-Default Root Certificate Settings

There is currently no UI to list all built-in root certificates for which you have overridden the default trust settings (bug 545498). However, you can use the certutil tool described in the previous section to list all the certificates in your personal database, which includes built-in root certificates whose trust you have changed along with added root certificates and many other kinds of certificates.

Run this command (doing it while the Mozilla application is running is probably unsupported but does not seem to cause problems in practice): 

# for older Mozilla products, leave off the 'sql:' part
certutil -d sql:PROFILE_DIR -L

where PROFILE_DIR is the path to your profile as noted above.

Root certificates will have trust fields of c, indicating a disabled trust bit, or CT or C, indicating an enabled trust bit. For example: 

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

My Favorite CA                                               CT,c,c
Wiretaps R Us CA                                             c,c,c
Retrieved from "https://wiki.mozilla.org/index.php?title=CA/Changing_Trust_Settings&oldid=1252980"