Certificate Trust Settings in Firefox 35

PKI Tutorials - Herong's Tutorial Examples - Version 2.04, by Dr. Herong Yang

PKI Tutorials - Herong's Tutorial Examples

∟Certificate Trust Settings in Firefox 35

This section provides a tutorial example on how to view certificate trust settings in Firefox 35. A root CA certificate can not be removed from Firefox 35. But its trust settings can be removed.

In the last tutorial, I got an error when try to import a root CA certificate that I deleted previously. The error message says that "This certificate already installed as a certificate authority."

Now let's find out why a deleted root CA certificate is still considered as installed in Firefox 35.

1. Check to see if "VeriSign Class 3 Public Primary Certification Authority - G5" certificate is still in Firefox 35 or not:

Run Firefox 35 again, and open the Certificate Manager dialog box.
Scroll down the list of installed certificates on the "Authorities" tab again and locate the "VeriSign Inc." section. "VeriSign Class 3 Public Primary Certification Authority - G5" certificate is indeed displayed there!

2. Check to see if Firefox is still giving me the certificate validation error or not:

Run Firefox 35, and visit https://login.yahoo.com.
The "This Connection is Untrusted" error message shows up again!

3. View the "VeriSign Class 3 Public Primary Certification Authority - G5" certificate again:

Run Firefox 35 again, and open the Certificate Manager dialog box.
Scroll down the list of installed certificates on the "Authorities" tab again and locate the "VeriSign Class 3 Public Primary Certification Authority - G5" certificate.
Click the "Edit Trust" button. The "Edit CA certificate trust settings" dialog box shows up.

Now I know the answer. When a root CA certificate is deleted, it is not removed from Firefox 35 at all. Firefox 35 only removes those trust settings associated with the certificate as shown in the picture below:

Remove Trust Setting on Certificate - Firefox 35 — Certificate Trust Settings in Firefox 35

Because checkbox "This certificate can identify web sites" is unchecked, Firefox 35 will not use the "VeriSign Class 3 Public Primary Certification Authority - G5" certificate to validate "login.yahoo.com" certificate. This is why I was getting the certificate validation error.

Obviously, to fix the certificate validation error, I need to reset checkbox "This certificate can identify web sites" and click OK.

Conclusion: A root CA certificate can not be removed from Firefox 35. But its trust settings can be removed.

Last update: 2015.

Table of Contents

About This Book

Introduction of PKI (Public Key Infrastructure)

Introduction of HTTPS (Hypertext Transfer Protocol Secure)

Using HTTPS with IE (Internet Explorer) 10

Using HTTPS with Chrome 40

►Using HTTPS with Firefox 35

Visiting "https" Web Site with Firefox 35

Viewing Server Certificate in Firefox 35