# How to Add mkcert CA to Firefox Trusted Certificates on macOS and Linux

> Easily add mkcert CA to Firefox trusted certificates on macOS and Linux. Install certutil, run mkcert -install, and restart Firefox to ensure secure local development.

- Repository: [Filippo Valsorda/mkcert](https://github.com/FiloSottile/mkcert)
- Tags: how-to-guide
- Published: 2026-03-05

---

**Run `mkcert -install` after installing the `certutil` binary (via `nss` on macOS or `libnss3-tools` on Linux) to automatically inject the mkcert root CA into Firefox’s NSS database, then restart Firefox to activate the trust.**

Firefox maintains its own certificate store using the Network Security Services (NSS) database rather than the operating system trust store, which requires specific tooling to modify. The `mkcert` tool automates this process by detecting Firefox profiles and using Mozilla's `certutil` utility to register the local Certificate Authority. According to the FiloSottile/mkcert source code, this integration is implemented in [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) and handles detection, installation, and verification across supported platforms.

## How mkcert Integrates with Firefox

When you execute `mkcert -install`, the application delegates Firefox certificate installation to specialized logic in **[`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go)**. This module performs three distinct operations to ensure the root CA is properly trusted by Firefox.

### Detecting NSS Tools

Before attempting installation, mkcert verifies that `certutil` is available on the system. This detection logic resides in **[`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) lines 48‑66**, where the application searches common binary paths and environment variables for the Mozilla NSS tool. Without `certutil`, mkcert cannot modify the SQLite-based certificate databases (`cert9.db`) or legacy Berkeley DB files (`cert8.db`) that Firefox uses.

### Installing into NSS Profiles

The core installation routine, located in **[`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) lines 89‑100**, iterates through discovered NSS database locations—including standard Firefox profiles in `~/.mozilla/firefox/`—and executes the equivalent of:

```bash
certutil -A -n "mkcert development CA" -t "C,," -i rootCA.pem -d sql:/path/to/profile

```

The trust attributes **`C,,`** designate the certificate as a trusted Certification Authority for SSL/TLS website identification.

### Verifying the Installation

Immediately after installation, mkcert validates the operation using the verification block in **[`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) lines 73‑87`. This runs `certutil -V` against each modified database to confirm the CA is present and trusted. If verification fails, mkcert emits an error message requesting environment details to help diagnose profile detection issues.

## Prerequisites for Firefox Certificate Installation

You must install the `certutil` binary before running mkcert. Select the appropriate command for your platform:

| Platform | Package | Installation Command |
|----------|---------|-------------------|
| **macOS** | `nss` (via Homebrew) | `brew install nss` |
| **Debian/Ubuntu** | `libnss3-tools` | `sudo apt install libnss3-tools` |
| **RHEL/CentOS/Fedora** | `nss-tools` | `sudo yum install nss-tools` or `sudo dnf install nss-tools` |
| **Arch Linux** | `nss` | `sudo pacman -S nss` |

**Note for Windows users:** Firefox on Windows utilizes the system certificate store, which `mkcert -install` already updates automatically. No additional NSS-specific steps are required.

## Step-by-Step Installation Guide

### 1. Install the Required Dependency

First, ensure `certutil` is available in your shell path:

```bash

# macOS

brew install nss

# Linux (Debian/Ubuntu example)

sudo apt install libnss3-tools

```

Verify the installation by running `certutil --version`. You should see output indicating the NSS Utilities version.

### 2. Run mkcert Installation

Execute the install command to register the CA with Firefox:

```bash
mkcert -install

```

Successful output includes a line confirming Firefox integration:

```

The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

```

### 3. Restart Firefox

Close all Firefox windows and restart the browser. Firefox caches the NSS database in memory during runtime, so changes made by `certutil` only take effect after a fresh launch.

## Verifying the Certificate in Firefox

To confirm the mkcert CA is trusted:

1. Open Firefox and navigate to `about:preferences#privacy`
2. Scroll to the **Certificates** section and click **View Certificates**
3. Select the **Authorities** tab
4. Locate the entry named **mkcert development CA** (or the organization name shown in `mkcert -CAROOT`)
5. Verify that "Trust this CA to identify websites" is checked

Alternatively, visit a site served with an mkcert-generated certificate. Firefox should display a secure connection indicator without warnings.

## Manual Import (When Automatic Installation Fails)

If `mkcert -install` reports failures or you prefer manual control, import the root CA through Firefox's UI:

```bash

# Locate the root certificate file

mkcert -CAROOT

# Returns a path like /home/username/.local/share/mkcert

```

Then in Firefox:

1. Open **Settings → Privacy & Security → View Certificates → Authorities**
2. Click **Import** and select `rootCA.pem` from the CAROOT directory
3. Check "Trust this CA to identify websites" when prompted

This achieves the same result as the automated process but bypasses potential `certutil` path detection issues.

## Limiting Installation to Firefox Only

On systems where you want to avoid modifying the system trust store and only update Firefox's NSS database, set the `TRUST_STORES` environment variable:

```bash
TRUST_STORES=nss mkcert -install

```

This restricts mkcert to the NSS/Firefox installation logic defined in [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go), skipping operations on the macOS Keychain or Linux system stores.

## Summary

- **Firefox uses NSS databases**, not the OS trust store, requiring `certutil` for automated CA installation on macOS and Linux.
- **Install `certutil`** via `brew install nss` (macOS) or your distribution's `libnss3-tools`/`nss-tools` package before running mkcert.
- **Execute `mkcert -install`** to automatically detect Firefox profiles and inject the root CA with trust level `C,,` (trusted for SSL).
- **Restart Firefox** after installation to clear the certificate cache and activate trust.
- **Use `TRUST_STORES=nss`** environment variable to target only Firefox without modifying system certificates.

## Frequently Asked Questions

### Why does Firefox require a restart after running mkcert?

Firefox maintains an in-memory cache of the NSS certificate database during runtime. While `mkcert` updates the physical SQLite database files (as implemented in [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) lines 89‑100), the browser only reloads these entries on startup. Restarting ensures the cached certificate list includes the newly added mkcert CA.

### Can I use mkcert with Firefox on Windows?

Yes, but Windows Firefox uses the Windows Certificate Store rather than an NSS database for root CAs. When you run `mkcert -install` on Windows, it updates the system trust store automatically, which Firefox respects immediately. No additional `certutil` installation or browser restart is required on Windows platforms.

### What does the "C,," trust attribute mean when mkcert installs the CA?

The `C,,` string is an NSS trust attribute where **C** indicates the certificate is trusted as a Certification Authority for SSL/TLS connections. This corresponds to checking "Trust this CA to identify websites" in Firefox's certificate manager. The implementation in [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) applies these attributes via the `certutil -A` command to ensure the CA can validate local development sites.

### How do I troubleshoot "certutil not found" errors during mkcert installation?

This error indicates the NSS tools are not in your system PATH. Install the appropriate package for your platform: `nss` via Homebrew on macOS, or `libnss3-tools` (Debian/Ubuntu) / `nss-tools` (RHEL/Fedora) on Linux. The detection logic in [`truststore_nss.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_nss.go) lines 48‑66 searches for this binary; if absent, mkcert cannot modify Firefox's certificate database and will skip the Firefox trust store installation.