How can I change the PKI certificate I'm using in Firefox?

Question

I have a dozen or so PKI certificates installed on my computer that I use for testing a web app. They represent the "users" Andy Tester, Billy Tester, Cindy Tester, &c. Fairly frequently, I need to test parts of the app that need multiple users to comment on something, or that behave differently depending on the viewer. In these situations, it'd be nice to be able to change certificates reliably, and if possible quickly.

How can I change which PKI certificate I'm using? Right now, I find that exiting Firefox 3.6/4 completely is necessary but not always sufficient for allowing me to choose a new cert. (In IE7/8, on the other hand, exiting does seem to be sufficient.) If there are multiple methods, fewer steps/easier steps would be preferred. A few websites I've seen recommend just deleting the certs and re-adding them, but that seems so awkward it can't possibly be right.

Answer 1

Your certificates and keys are kept in your Firefox profile. So the simplest solution would be to have multiple profiles for Andy, Billy and Cindy. See mozillaZine's Command line arguments on how to start Firefox with different profiles. More info can be found in Managing profiles.

If for some reason this is not an acceptable solution, a more cumbersome way of doing it is to use one profile but to switch the certificate/keys files so as to have a separate set for Andy, Billy and Cindy. This means exiting FF, copying the files, and restarting FF in order to change identity (but using only one identity at a time).

The involved files are :

• "key3.db" -- Key database
• "cert8.db" -- Client Certificate database

The following files may also be useful :

• "secmod.db" -- security modules description (?)
• "signons.txt" -- saved passwords (depreciated?)

Answer 2

Private Browsing Mode

In private browsing mode, the private session is isolated from the main session. Both sessions are able to operate with a separate set of client certificates.

The main session will use the selected certificates for the life of the process. This is a drawback in a test environment. However, private sessions can be spawned and a new certificate can be selected each time. It is not necessary to restart the Firefox application.

For example, you can open a private window (Ctrl+Shift+P) and select the "Andy Tester" cert. When done testing with Andy, close the private window (Ctrl+Shift+W). Reopening the private window allows you to choose a different cert, such as "Billy Tester".

This is the quickest and most reliable way I have found to switch between client certificates in a test environment. Nonetheless, it's a good idea to use an "anonymous" browser session when testing.

This concept also works similarly with Chrome's Incognito mode.