How to Add mkcert CA to Firefox Trusted Certificates on macOS and Linux

Run mkcert -install after installing the certutil binary (via nss on macOS or libnss3-tools on Linux) to automatically inject the mkcert root CA into Firefox’s NSS database, then restart Firefox to activate the trust.

Firefox maintains its own certificate store using the Network Security Services (NSS) database rather than the operating system trust store, which requires specific tooling to modify. The mkcert tool automates this process by detecting Firefox profiles and using Mozilla's certutil utility to register the local Certificate Authority. According to the FiloSottile/mkcert source code, this integration is implemented in truststore_nss.go and handles detection, installation, and verification across supported platforms.

How mkcert Integrates with Firefox

When you execute mkcert -install, the application delegates Firefox certificate installation to specialized logic in truststore_nss.go. This module performs three distinct operations to ensure the root CA is properly trusted by Firefox.

Detecting NSS Tools

Before attempting installation, mkcert verifies that certutil is available on the system. This detection logic resides in truststore_nss.go lines 48‑66, where the application searches common binary paths and environment variables for the Mozilla NSS tool. Without certutil, mkcert cannot modify the SQLite-based certificate databases (cert9.db) or legacy Berkeley DB files (cert8.db) that Firefox uses.

Installing into NSS Profiles

The core installation routine, located in truststore_nss.go lines 89‑100, iterates through discovered NSS database locations—including standard Firefox profiles in ~/.mozilla/firefox/—and executes the equivalent of:

certutil -A -n "mkcert development CA" -t "C,," -i rootCA.pem -d sql:/path/to/profile

The trust attributes C,, designate the certificate as a trusted Certification Authority for SSL/TLS website identification.

Verifying the Installation

Immediately after installation, mkcert validates the operation using the verification block in **truststore_nss.go lines 73‑87. This runs certutil -V` against each modified database to confirm the CA is present and trusted. If verification fails, mkcert emits an error message requesting environment details to help diagnose profile detection issues.

Prerequisites for Firefox Certificate Installation

You must install the certutil binary before running mkcert. Select the appropriate command for your platform:

Platform	Package	Installation Command
macOS	nss (via Homebrew)	brew install nss
Debian/Ubuntu	libnss3-tools	sudo apt install libnss3-tools
RHEL/CentOS/Fedora	nss-tools	sudo yum install nss-tools or sudo dnf install nss-tools
Arch Linux	nss	sudo pacman -S nss

Note for Windows users: Firefox on Windows utilizes the system certificate store, which mkcert -install already updates automatically. No additional NSS-specific steps are required.

Step-by-Step Installation Guide

1. Install the Required Dependency

First, ensure certutil is available in your shell path:

# macOS

brew install nss

# Linux (Debian/Ubuntu example)

sudo apt install libnss3-tools

Verify the installation by running certutil --version. You should see output indicating the NSS Utilities version.

2. Run mkcert Installation

Execute the install command to register the CA with Firefox:

mkcert -install

Successful output includes a line confirming Firefox integration:

The local CA is now installed in the Firefox trust store (requires browser restart)! 🦊

3. Restart Firefox

Close all Firefox windows and restart the browser. Firefox caches the NSS database in memory during runtime, so changes made by certutil only take effect after a fresh launch.

Verifying the Certificate in Firefox

To confirm the mkcert CA is trusted:

1. Open Firefox and navigate to about:preferences#privacy
2. Scroll to the Certificates section and click View Certificates
3. Select the Authorities tab
4. Locate the entry named mkcert development CA (or the organization name shown in mkcert -CAROOT)
5. Verify that "Trust this CA to identify websites" is checked

Alternatively, visit a site served with an mkcert-generated certificate. Firefox should display a secure connection indicator without warnings.

Manual Import (When Automatic Installation Fails)

If mkcert -install reports failures or you prefer manual control, import the root CA through Firefox's UI:

# Locate the root certificate file

mkcert -CAROOT

# Returns a path like /home/username/.local/share/mkcert

Then in Firefox:

1. Open Settings → Privacy & Security → View Certificates → Authorities
2. Click Import and select rootCA.pem from the CAROOT directory
3. Check "Trust this CA to identify websites" when prompted

This achieves the same result as the automated process but bypasses potential certutil path detection issues.

Limiting Installation to Firefox Only

On systems where you want to avoid modifying the system trust store and only update Firefox's NSS database, set the TRUST_STORES environment variable:

TRUST_STORES=nss mkcert -install

This restricts mkcert to the NSS/Firefox installation logic defined in truststore_nss.go, skipping operations on the macOS Keychain or Linux system stores.

Summary

• Firefox uses NSS databases, not the OS trust store, requiring certutil for automated CA installation on macOS and Linux.
• Install certutil via brew install nss (macOS) or your distribution's libnss3-tools/nss-tools package before running mkcert.
• Execute mkcert -install to automatically detect Firefox profiles and inject the root CA with trust level C,, (trusted for SSL).
• Restart Firefox after installation to clear the certificate cache and activate trust.
• Use TRUST_STORES=nss environment variable to target only Firefox without modifying system certificates.

Frequently Asked Questions

Why does Firefox require a restart after running mkcert?

Firefox maintains an in-memory cache of the NSS certificate database during runtime. While mkcert updates the physical SQLite database files (as implemented in truststore_nss.go lines 89‑100), the browser only reloads these entries on startup. Restarting ensures the cached certificate list includes the newly added mkcert CA.

Can I use mkcert with Firefox on Windows?

Yes, but Windows Firefox uses the Windows Certificate Store rather than an NSS database for root CAs. When you run mkcert -install on Windows, it updates the system trust store automatically, which Firefox respects immediately. No additional certutil installation or browser restart is required on Windows platforms.

What does the "C,," trust attribute mean when mkcert installs the CA?

The C,, string is an NSS trust attribute where C indicates the certificate is trusted as a Certification Authority for SSL/TLS connections. This corresponds to checking "Trust this CA to identify websites" in Firefox's certificate manager. The implementation in truststore_nss.go applies these attributes via the certutil -A command to ensure the CA can validate local development sites.

How do I troubleshoot "certutil not found" errors during mkcert installation?

This error indicates the NSS tools are not in your system PATH. Install the appropriate package for your platform: nss via Homebrew on macOS, or libnss3-tools (Debian/Ubuntu) / nss-tools (RHEL/Fedora) on Linux. The detection logic in truststore_nss.go lines 48‑66 searches for this binary; if absent, mkcert cannot modify Firefox's certificate database and will skip the Firefox trust store installation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}