Certificate Trust Settings in Mozilla Firefox

PKI Tutorials - Herong's Tutorial Examples

∟Certificate Trust Settings in Mozilla Firefox

This section provides a tutorial example on how to view certificate trust settings in Mozilla Firefox. A root CA certificate can not be removed from Mozilla Firefox. But its trust settings can be removed.

In the last tutorial, I got an error when try to import a root CA certificate that I deleted previously. The error message says that "This certificate already installed as a certificate authority."

Now let's find out why a deleted root CA certificate is still considered as installed in Mozilla Firefox.

1. Check to see if "DigiCert High Assurance EV Root CA" certificate is still in Mozilla Firefox or not:

Run Mozilla Firefox again, and open the Certificate Manager dialog box.
Scroll down the list of installed certificates on the "Authorities" tab again and locate the "DigiCert Inc" section. "DigiCert High Assurance EV Root CA" certificate is indeed displayed there!

2. Check to see if Firefox is still giving me the certificate validation error or not:

Run Mozilla Firefox, and visit https://login.yahoo.com.
The "This Connection is Untrusted" error message shows up again!

3. View the "DigiCert High Assurance EV Root CA" certificate again:

Run Mozilla Firefox again, and open the Certificate Manager dialog box.
Scroll down the list of installed certificates on the "Authorities" tab again and locate the "DigiCert High Assurance EV Root CA" certificate.
Click the "Edit Trust" button. The "Edit CA certificate trust settings" dialog box shows up.

Now I know the answer. When a root CA certificate is deleted, it is not removed from Mozilla Firefox at all. Mozilla Firefox only removes those trust settings associated.

Because checkbox "This certificate can identify websites" is unchecked, Mozilla Firefox will not use the "DigiCert High Assurance EV Root CA" certificate to validate "login.yahoo.com" certificate. This is why I was getting the certificate validation error.