4 ms·
Chrome uses the OS level cert store, whereas Mozilla uses it's own.
by mrkstu 6y ago
Chrome uses the OS level cert store, whereas Mozilla uses it's own.
- ocdtrekkie 6y agoThis is configurable for both, I believe. It's common for enterprises to switch Firefox to use the OS store to support internal certificates.
- mrkstu 6y agoYou can easily import cert's into OS stores. I've actually rarely seen Firefox as a first option, more likely as a secondary option. You're likely going to need to manipulate the OS store regardless, so Firefox is just extra work.
- pitaj 6y agoI think you misinterpreted his comment. He was saying Firefox by default uses its own store, so enterprises switch it to use the OS store when they need it to use internal certs.
- mrkstu 6y agoAh, that's probably the more reasonable interpretation, thanks.
- tialaramex 6y agoSpecifically Mozilla provides a flag which has the effect of accepting the additional corporate trust only. So e.g. if Microsoft decides for $1B cash they trust Honest Abe's Totally American For-Profit Church O'Certs and ships a Windows 10 update to enable that, Firefox still won't accept Abe's bogus google.com cert even with the enterprise mode on. But if your head of IT decides they'd very much like to issue certificates for internal-test-server.example and pushes a new root CA from their laptop via Group Policy, Firefox in enterprise mode will trust that cert because it was local policy. Basically the idea is Mozilla won't substitute Microsoft's decisions for their own, but your own local certificate policies are different. So you can opt into the latter in Firefox, but not the former.
- mrkstu 6y agoChrome on non-ChromeOS can't be configured with its own cert store. It just isn't there, though they keep a list of some black-listed root CAs. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...