<div dir="ltr"><div>It should just be about putting them in the right location and setting the Certificates->Install policy (if they aren't being imported from the window store).</div><div><br></div><div>See:</div><div><br></div><div><a href="https://github.com/mozilla/policy-templates/blob/master/README.md#certificates--install">https://github.com/mozilla/policy-templates/blob/master/README.md#certificates--install</a></div><div><br></div><div>Are these client certificates?</div><div><br></div><div>Mike Kaply<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Aug 2, 2019 at 4:18 PM Hoang (US), Victor T <<a href="mailto:victor.t.hoang@boeing.com">victor.t.hoang@boeing.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-1141010715319064534WordSection1">
<p class="MsoNormal">Hello,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My name is Victor. I was wondering if anyone could share any experience/expertise/solutions with switching over to policy for managing certificates to pull from the windows store. I’m running into some issues even after following some of
the guides about how to try and pull from my organizations windows store locations from
<a href="https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox" target="_blank">
https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox</a>. It seems like the instructions might be a little broad/high level so I could be missing some things. Following the guide, I have security.enterprise_roots.enabled set to true
and checked the windows store certificate location in regedit.exe and mmc and they seem to already exist (perhaps not in the right directory?). I asked someone in my organization and they mentioned that all the stores can be found on the console root (Local
Computer) under trusted root certification Authorities <span style="font-family:Wingdings">
à</span> Certificates and it all seems to be there as well.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">My question:<u></u><u></u></p>
<p class="gmail-m_-1141010715319064534MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>It seems like firefox checks HKLM\SOFTWARE\Microsoft\SystemCertificates according to the support page. I’m using regedit.exe to navigate to the directory, but I don’t see any sort of “Import” option for the certificates I want
to embed. I’m wondering how I can add my certificates into the location required by firefox? This is what I speculate to be the culprit.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Background:<u></u><u></u></p>
<p class="gmail-m_-1141010715319064534MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Switching from FF 60.8 ESR cck2 over to FF 68.0.1 ESR with policy.json<u></u><u></u></p>
<p class="gmail-m_-1141010715319064534MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Able to do majority of things such as setting up proxy, changing home page, and Trusted Devices installed (for CSSI Library badge authentication, etc)<u></u><u></u></p>
<p class="gmail-m_-1141010715319064534MsoListParagraph"><u></u><span style="font-family:Symbol"><span>·<span style="font:7pt "Times New Roman"">
</span></span></span><u></u>Unable to have certificates be read from the windows store via policy unless I manually add them to the Certificate Manager in firefox. (Secure Connection Failed: SSL_ERROR_HANDSHAKE_FAILURE_ALERT)<u></u><u></u></p>
<p class="MsoNormal"><span style="color:rgb(31,73,125)">Thanks all,<br>
Victor Hoang <u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
</blockquote></div>