Importing SSL Certificate into Firefox using GPO

Hi Experts,

I would like to import a local CA SSL certificate in Firefox and then deploy this to the computers on the domain using GPO.

I know I can manually import the SSL cert into the browser and then copy the cert8.db to the other computers on the domain.

Any suggestions and how to accomplish this task ?

The machines on the domain are running Windows 7 and Windows 8.1 OS.

Thanks for your help with this item.
LVL 1
TeavanaAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

McKnifeCommented:
You ask how to copy the certs8.db, right? We did this, can give you a small script in a few hours when I have access to it.
TeavanaAuthor Commented:
McKnife,

Thank you for responding, I appreciate it. Yes, I need to distribute the Cert8.db to all the computers on the domain so that users will not get the certificate error message when they try to access a secure site.

am I approaching this the correct way? My end goal is to have the Firefox browser trusting my local CA SSL cert for all the users that uses the machine. IE and Chrome works ok but Firefox uses its own cert DB.

Thanks
McKnifeCommented:
should have been:
for /f "tokens=1,2 delims=/" %%a in ('findstr Path %appdata%\Mozilla\Firefox\profiles.ini') do copy \\server\share\cert8.db %appdata%\Mozilla\Firefox\profiles\%%b\cert8.db /y

Open in new window

Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

TeavanaAuthor Commented:
Thank you for the code. How do I run this code. Do I copy it and make a batch file?
McKnifeCommented:
Correct. Or place that line in your domain logon script.
TeavanaAuthor Commented:
OK, Awesome, I will try this now.

Quick question, will this delete the users favorites that they currently have in Firefox?

Thanks
McKnifeCommented:
No, just copy and eventually replace this one file.
TeavanaAuthor Commented:
Thank you again....  The script is working great.

I noticed that there are some Windows XP and Windows 8.1 client machines.

How would I modify this script to accommodate these machines?

Thanks
McKnifeCommented:
No need for action.
TeavanaAuthor Commented:
I do not understand ?/??
McKnifeCommented:
Runs on xp/vista/7/8/10 - all the same, no need to adjust anything.
TeavanaAuthor Commented:
Awesome. I noticed that the path for the XP machines is different..... My Documents\etc.

Should I run this as a user policy or a machine policy?

What is your recommendations?

Thank you again for your help with this item.
McKnifeCommented:
Has to run as a user policy, put this code line into the logon script inside that policy.
TeavanaAuthor Commented:
OK, just wanted to verify.
TeavanaAuthor Commented:
I am sorry for the delaying in getting back to you. I am having an issue with my Windows XP machine, X86 (In the process of replacing them).

I deployed the script and it works great for the Windows 7 machines but it does not work for the XP machines.

I will test this on the Windows 8/8.1 machines to make this working.

Any thoughts on the Windows XP machines?

Thanks.
McKnifeCommented:
Execute this code on a command line on xp and quote the error:
for /f "tokens=1,2 delims=/" %a in ('findstr Path %appdata%\Mozilla\Firefox\profiles.ini') do copy \\server\share\cert8.db %appdata%\Mozilla\Firefox\profiles\%b\cert8.db /y
[same code as before, just modified for the command line]
TeavanaAuthor Commented:
OK! doing this now, thanks.
TeavanaAuthor Commented:
I am getting the following message.

X:\>for /f "tokens=1,2 delims=/" %a in ('findstr Path %appdata%\Mozilla\Firefox\
profiles.ini') do copy \\server\share\\cert8.db %ap
pdata%\Mozilla\Firefox\profiles\%b\cert8.db /y
FINDSTR: Cannot open C:\Documents
FINDSTR: Cannot open and
FINDSTR: Cannot open Settings\User_Name\Application
FINDSTR: Cannot open Data\Mozilla\Firefox\profiles.ini
TeavanaAuthor Commented:
The user account that is running this script has admin access on this machine.
TeavanaAuthor Commented:
Please see the path for the cert8 db on this XP Machine:

C:\Documents and Settings\User_Name\Application Data\Mozilla\Firefox\Profiles\cw83xe5i.default


Thanks
McKnifeCommented:
Ok, my bad. The error: That path needs to be enclosed in "".
Make it "%appdata%\...profiles.ini"
TeavanaAuthor Commented:
Is the following correct?


for /f "tokens=1,2 delims=/" %%a in (findstr Path "%appdata%\Mozilla\Firefox\profiles.ini") do copy \\server\share\cert8.db %appdata%\Mozilla\Firefox\profiles\%%b\cert8.db /y
McKnifeCommented:
Not quite,you missed the 2 '
for /f "tokens=1,2 delims=/" %%a in ('findstr Path "%appdata%\Mozilla\Firefox\profiles.ini"') do copy \\server\share\cert8.db %appdata%\Mozilla\Firefox\profiles\%%b\cert8.db /y 

Open in new window

TeavanaAuthor Commented:
McKnife,

I am sorry for the delay on this item. I assigned this to my sys admin and the ball got dropped.

I will test the above code and respond to you.

I appreciate your patience with this item.
LeeTutorretiredCommented:
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
TeavanaAuthor Commented:
McKnife,

Thank you for your help this this issue, I am sorry for the delay in updating this item.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.