Firefox Snap doesn't recognize root certificate

[YamiYukiSenpai]

Just mine, but it’s actually just Neon with Tuxedo kernel

But the rest are standard Kubuntu/Ubuntu 24.04

I poked into few of the ones I deployed and I noticed that all of them DO have the certificates, and /etc is indeed binding

However, Firefox still doesn’t use those certificates

[ogra]

even if you properly put them into /etc/ssl/certs ?

[YamiYukiSenpai]

Nope. In fact, putting my certs there actually breaks Chrome’s access to our certificates. Didn’t seem to have fixed Firefox’s certificate either so it’s still a loss.

I have a separate system with Kubuntu 24.04, so going forward, I’ll use that to test instead of my Neon 24.04. I can at least confirm that the certificates in /etc/ssl/certs/ca-certificates.crt match with the one in the system for Ubuntu and Kubuntu, and tested to be sure that binds are working correctly.

I only researched this again because I got the time, and I realized that my workaround to force Chrome to see our root and intermediate certificates for 22.04 didn’t work for 24.04 (that one I just solved).

[YamiYukiSenpai]

I tested other Chromium-based browsers and it’s not working.

[YamiYukiSenpai]

@YamiYukiSenpai

Here’s the Ansible config I push on Ubuntu computers in our environment:

- name: Make sure p11-kit is installeed
  ansible.builtin.apt:
    name:
      - p11-kit
      - p11-kit-modules

- name: Backup libnssckbi.so
  ansible.builtin.copy:
    src: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so
    dest: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so.old
    remote_src: true
  ignore_errors: true

- name: Delete original libnssckbi.so
  ansible.builtin.file:
    name: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so
    state: absent

- name: Symlink p11-kit-trust.so to libnssckbi.so
  ansible.builtin.file:
    src: /usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so
    dest: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so
    state: link
  ignore_errors: true

- name: Create Intermediate certificate
  ansible.builtin.copy:
    dest: /usr/local/share/ca-certificates/<hidden>_intermediate_ca-chain.crt
    content: |
      -----BEGIN CERTIFICATE-----
      <hidden>
      -----END CERTIFICATE-----
    mode: '0644'

- name: Create root certificate
  ansible.builtin.copy:
    dest: /usr/local/share/ca-certificates/<hidden>_root_ca-chain.crt
    content: |
      -----BEGIN CERTIFICATE-----
      <hidden>
      -----END CERTIFICATE-----
    mode: '0644'

- name: Update certificate store
  ansible.builtin.command: /usr/sbin/update-ca-certificates --fresh
  register: ubuntu_cert
  changed_when: ubuntu_cert.rc != 0

Just a hypothesis, but I think this needs to be done inside the Snap itself. Its weird that I have to do this hacky workaround just for a web browser to use the system’s certs.

I’ve confirmed that it works with Chrome (local install), and 24.04 has a different libnssckbi.so path (already tweaked my Ansible script at work).

• 22.04: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so
• 24.04: /usr/lib/x86_64-linux-gnu/libnssckbi.so