Starting with Firefox 120, FF can now automatically trust *custom* TLS certificates from OS store reddit / selfhosted ---------------------------------------------------------------------- Valuable-Question706 · 2023-11-22 21:42 [https://support.mozilla.org/en-US/kb/automatically-trust-third-party- certificates](https://support.mozilla.org/en-US/kb/automatically- trust-third-party-certificates) For those of us who run in-house CA, now there's one one less step in rollout procedures. Previously, FF trusted only Mozilla Certificate Store. Since release 120, it continues to trust its own store, but also detects any **custom** Root CAs you've added to your OS store and allows to trust them. https://preview.redd.it/u84glpcdyy1c1.png?width=724&format=png&auto=we bp&s=3ab4114f777c301d1f5fa8e24ceef66ddbdceb38 ---------------------------------------------------------------------- z3ndo · 2023-11-22 21:58 What's the reason for using your own CA these days? Paranoia? ---------------------------------------------------------------------- sza_rak · 2023-11-22 22:04 You really ask this question on a sub on which people make posts like "I bought a hardware, give me a list of things I can host"... There doesn't need to be a valid reason, other than fun or practice. ---------------------------------------------------------------------- dexter3player · 2023-11-22 22:29 E.g. network equipment with a self-signed web interface. ---------------------------------------------------------------------- JohnyMage · 2023-11-22 22:31 Https on internal services without access to let's encrypt and such. ---------------------------------------------------------------------- txTxAsBzsdL5 · 2023-11-22 23:15 Right, things like Vaultwarden won't let you login using HTTP, but a lan-only setup is very attractive for something like passwords. ---------------------------------------------------------------------- Bagel42 · 2023-11-22 23:23 I was about to setup vault warden, good to know I'll beed this ---------------------------------------------------------------------- Xenthys · 2023-11-23 00:18 I recommend using Let's Encrypt with DNS challenge anyway, it's easier than having to manage your own PKI and install your root CA on every device you own. ---------------------------------------------------------------------- danya02 · 2023-11-23 00:52 Personally, I think this is a bad idea. In my country there is currently a push to get people to install a government-issued root CA, which is a cause for concern. It's currently not really happening much, because normies don't know how to do it, and also because there's basically only a couple government sites that use it and nothing else. But anything that makes the process easier is a bad idea, IMO. Though most people use Chrome, which already trusts the OS store, so I guess it isn't that big of a deal. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-23 01:26 That's odd. You would think eventually they would just ban browsers and OSs that don't include the cert. Sort of kidding, but what is the point of govt. doing this if you aren't willing to go all the way? ---------------------------------------------------------------------- BarServer · 2023-11-23 01:46 RFC 6762, Appendix G. Private DNS Namespaces. Domains like: * .intranet. * .internal. * .private. * .corp. * .home. * .lan. ---------------------------------------------------------------------- lunakoa · 2023-11-23 01:56 Client certs. ---------------------------------------------------------------------- zfa · 2023-11-23 03:23 Getting the government root certs installed isn't the end game, obviously. Standard boiling the frog approach. ---------------------------------------------------------------------- z3ndo · 2023-11-23 03:51 Fair enough. FWIW - I only allow access to most subdomains from my local network but Caddy still allows for HTTPS based ACME cert verification even on those domains. I can understand why some people might go the extra mile and not forward anything in from the outside and thus not have that option. ---------------------------------------------------------------------- z3ndo · 2023-11-23 03:53 Yeah - that makes sense. I use Vaultwarden but am not doing a local- only setup so I get LetsEncrypt certs. Not for everyone - so a custom CA it is. ---------------------------------------------------------------------- z3ndo · 2023-11-23 03:54 Agreed. Not sure why my question got downvoted. Managing your own CA is a headache unless it's something you just want to do. ---------------------------------------------------------------------- z3ndo · 2023-11-23 03:57 Take a look at the other replies to my question for useful contributions to the conversation. ---------------------------------------------------------------------- danya02 · 2023-11-23 06:54 The publicly-stated reason for this is "what if the countries where the CAs are stop serving us?" -- the same justification is also used for why they're building they own DNS root servers, because "what if the rest of the world decides to stop serving our domains?" I personally find this improbable because the various organizations responsible for both have said that they're not going to do this because of the disruption it would cause. Where it gets iffy is that their press statements have said that 100% of traffic now flows through their DPI boxes they've mandated every ISP to have installed; and, indeed, one ISP recently got taken offline for about 6 hours because that box malfunctioned. So it is not infeasible that they will do a statewide MITM, but they're not going to until it's known to not break something they consider critical. What I would really like is for TLS to have wide support for CA constraints, perhaps user-specified. Then you could add this certificate to your browser, but set it to only be trusted for the sites that actually use it (a tax office, if I remember correctly), and then not worry about that being used for MITMs for any other sites. ---------------------------------------------------------------------- Valuable-Question706 · 2023-11-23 07:03 I guess it's because of the wording, and then all other people just continue the downvoting trend... ---------------------------------------------------------------------- Valuable-Question706 · 2023-11-23 07:09 And personally I'm glad to have it. I've set up my own [step- CA](https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi- yubikey/), and now I have one less step when enrolling a new desktop, be it Windows or Linux. ---------------------------------------------------------------------- Gabe_Isko · 2023-11-23 08:19 Yeah, that sucks. I assume most people use a vpn? ---------------------------------------------------------------------- danya02 · 2023-11-23 21:03 There's a lot of sites that the DPI boxes block, and a sizeable subset of those are things that normies are interested in -- examples include Instagram and other Metabook services (excluding Whatsapp, for now), Medium, Twitter, Google Play (intermittently, depending on random factors it seems), and a grab bag of random international news sites like BBC or the Daily Express. So yeah, a lot of people have VPNs.