I work as an IT guy for a public federal university in Brazil. Government agencies and institutions have to deal with a lot of outdate applications and a mix of browsers to make them work.

For example: Some web applications works only in Google Chrome due to bad design and coding. Others still use Java Applets and the newest working combination of browser and Java JRE is Mozilla Firefox 51 and Java 8 update 121. There are also applications written for MS Windows that validate certificates using certification authorities installed in Windows.

One thing in common to most of all applications is that they need to authenticate users through A3 Certificate (most of the times SafeNet 5100 USB Token).

So far, so good. The problem is: our IT department needs to deploy all applications, drivers and install the certificates of at least 33 brazilian certification authorities using files with p7b and crt extensions, like the ones listed here:

Certification Authority files

Every time we need to reinstall Windows on a PC or when we get a new one, we have to manually install every single file, one by one, one time in Windows by right-clicking the files and then clicking in Install Certificate option and then inside Mozilla Firefox v51 authorities option selecting one-by-one.

Another issue is that most of users use their own notebooks (BYOD). It's own duty to install and setup all these certificates.

Is there any way, feature, program or script to make things easier automating this process of certification authority install for Windows, Google Chrome and Mozilla Firefox using these p7b and crt files?

We lost a lot of time doing that manually...

  • 1
    Why wouldn’t you create an image of a system after those certificates are installed?
    – Ramhound
    Aug 29 '18 at 20:43
  • We already use images for all computers where possible. However, we have to deal with BYOD. Some users bring their own notebooks to work, and in that case images cannot apply.
    – adamitj
    Aug 30 '18 at 21:48
  • For BYOD what about using a virtual application system such as Citrix or RemoteApps? The virtual app can be running on a system with all the required certs installed and verified and then it can run on ANY system the virtual app framework supports. Sep 6 '18 at 17:41
  • We have to stick to what we have today. Buying new technologies like these ones you mentioned is out of question. Too much rules to apply, little money to invest. In fact, because we're a federal public university bounded to the federal government budget, AND, the budget is always decreasing over the years... this means we have no choices.
    – adamitj
    Sep 7 '18 at 22:12

The easiest way is to import the certificate into a sample firefox-profile and then copy the cert8.db to the users you want equip with the certificate.

First import the certificate by hand into the firefox profile of the sample-user. Then copy

/home/${USER}/.mozilla/firefox/${randomalphanum}.default/cert8.db (Linux/Unix)

%userprofile%\Application Data\Mozilla\Firefox\Profiles\%randomalphanum%.default\cert8.db (Windows)

into the users firefox-profiles. That's it. If you want to make sure, that new users get the certificate automatically, copy cert8.db to:

/etc/firefox-3.0/profile (Linux/Unix)

%programfiles%\firefox-installation-folder\defaults\profile (Windows)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.