how to add a certificate to firefox or chrome #344

iblfw · 2019-09-12T09:40:28Z

Now there is a website which must be visited by a certificate. What i should do? Add the certificate into
your image or set the the certificate in selenium webdriver.Remote? I have no idea, thank for any advise

gknepper · 2019-11-07T23:49:37Z

The only way for now is actually update the image. I did that, that's my Dockerfile:

For chrome it's working.. for Firefox I'm copying a profile already created with the certificate inside because there's no way to initialize the firefox profile from command line.

Hope it helps

FROM elgalu/selenium

USER root
RUN sudo rm -rf /etc/apt/sources.list.d/google-chrome.list

ENV CHROME_ARGS='--no-sandbox --disable-setuid-sandbox --disable-cpu --disable-infobars --ignore-certificate-errors'

ADD certificate.crt /usr/local/share/ca-certificates/certificate.crt
RUN sudo update-ca-certificates

RUN apt -qqy update \
    && apt -qqy --no-install-recommends install \
    libnss3-tools \
    libnss3-1d 
   
USER seluser

# CHROME
RUN mkdir -p /home/seluser/.pki/nssdb \
    && certutil -d /home/seluser/.pki/nssdb -N \
    && certutil -d sql:/home/seluser/.pki/nssdb -L \
    && certutil -d sql:/home/seluser/.pki/nssdb -A -t "CT,C,C" -n CertCA -i /usr/local/share/ca-certificates/certificate.crt \
    && certutil -d sql:/home/seluser/.pki/nssdb -L

# FIREFOX
ADD firefoxprofile.tar.gz /home/seluser/

chrismcmahon · 2019-11-18T19:12:41Z

@gknepper I need to do exactly this for Firefox, and you seem to have found the only way.

When starting the first time, Firefox will create a file 'profiles.ini' http://kb.mozillazine.org/Profiles.ini_file that points to a default profile directory.

That profile needs to have added a 'cert9.db' file containing the certificate in question and also have the preference for 'security.default_personal_cert" changed to "Select Automatically".

I can see that you seem to be updating the dockerfile at https://github.com/elgalu/docker-selenium/blob/1468f6d9aa980afabbe98a000d8ef5598b58224a/Dockerfile but can you explain what the file firefoxprofile.tar.gz in "ADD firefoxprofile.tar.gz /home/seluser/" contains?

I can see how that might contain the necessary cert9.db file and prefs.js file, but I don't see how that changes the profile that Firefox created in the necessary ways. Does it also replace profiles.ini somehow?

Thanks, I really hope to hear from you.

gknepper · 2019-11-18T19:35:09Z

That's the exactly main problem on firefox. When creating the profile on command line, firefox don't create the wallet (cert9.db) so as a workaround I was trying to start firefox as headless and kill after some seconds just to create the entire structure (profile) locally. I what I did instead was create a profile in my local machine where I added every setting that I need ( certificates and proxy settings) then I saved this content (entire /home/user/.mozilla) in this firefoxprofile.tar.gz file. It's "hardcoded" but works.

chrismcmahon · 2019-11-18T19:49:24Z

Hahaha, I understand!

Do you think it would be possible to do for example

ADD /home/seluser/.mozilla/profiles.ini (POINTS TO CUSTOM PROFILE 'myprofile.default-release)
ADD /home/seluser/.mozilla/profiles/myprofile.default-release/cert9.db
ADD /home/seluser/.mozilla/profiles/myprofile.default-release/prefs.js

and would it require adding the other approximately 50 files to myprofile.default-release also? Or do you think Firefox would create those in place upon not finding them in the place that profiles.ini would tell it to look?

Again, thank you very much for the answers and for helping, I've been reading about this problem for some time now.

gknepper · 2019-11-18T19:58:41Z

Well, I think this is doable but I don't compress the profile all this 50 files and all this structure in a tar.gz or a zip file ?

The other think that I can do is just add a profile without any configuration/certificate inside your container (ADD) and use the same command that I used on chrome app to update the the firefox cert9.db. It's 100% compatible, I've tested already.

chrismcmahon · 2019-11-18T20:13:20Z

I am still learning about docker-selenium, but it seems to me that doing

ADD profile.ini /home/seluser/.mozilla/profiles.ini
ADD cert9.db /home/seluser/.mozilla/profiles/myprofile.default-release/cert9.db
ADD prefs.js /home/seluser/.mozilla/profiles/myprofile.default-release/prefs.js

might work. I'll try that soon.

chrismcmahon · 2019-11-19T20:56:59Z

@gknepper I have done exactly what you have done and created a .tar.gz file for an entire .mozilla directory in Ubuntu. Is is true that the way you use this is to

git clone the project and cd to the Dockerfile directory
edit the Dockerfile with your additions
"docker build -t selenium ."

When you edit the Dockerfile do you put "ADD firefoxprofile.tar.gz /home/seluser/" as the last line of the file?
Thanks!

gknepper · 2019-11-19T21:03:00Z

Hello @chrismcmahon, No I'm not cloning the project. I don't need to. I'm reusing the previous working image as you may check in the first line: (FROM elgalu/selenium). So I'm just adding more layers on top of the previous image. It's faster then rebuild everything from scratch.

So I created Dockerfile and ran a docker build only.

chrismcmahon · 2019-11-19T21:32:28Z

@gknepper thanks again, you are saving me a lot of time! So I think that if I had a Dockerfile that looks like

FROM elgalu/selenium

USER seluser

ADD ffprofile.tar.gz /home/seluser/

then do docker build -f /path/to/a/Dockerfile . I should get the expected result?

gknepper · 2019-11-19T21:35:45Z

@chrismcmahon Yes!

chrismcmahon · 2019-11-20T18:31:19Z

Something is going wrong with this process, I think I have a misunderstanding...

On a Ubuntu system I installed Firefox, installed a certificate and changed Preferences. I did 'tar -czvf' to create 'ffprofile.tar.gz' that contains the whole '.mozilla' directory. I transferred this file back to my system running docker.

Just to be sure, I unzipped the file with 'tar -xvf ffprofile.tar.gz' and I can see
ls .mozilla/firefox/0pe1dj08.default-release/cert9.db
.mozilla/firefox/0pe1dj08.default-release/cert9.db
(and the preferences are correct also)

I do
docker build -f Dockerfile .
Sending build context to Docker daemon 24.03 MB
Step 1/3 : FROM elgalu/selenium
---> cf706845a6b0
Step 2/3 : USER seluser
---> Using cache
---> ee3c3afef1c9
Step 3/3 : ADD ffprofile.tar.gz /home/seluser/
---> Using cache
---> 39a865d6854c
Successfully built 39a865d6854c

I do
docker container export grid_firefox_1 > foo.tar
and untar the file with 'tar xopf foo.tar'

I have no Profile directory in the docker image

dockerfilesystem]# ls -al home/seluser/.mozilla/firefox/
total 0
drwxrwxrwx. 4 root root 46 Oct 11 10:08 .
drwxrwxrwx. 3 root root 20 Oct 11 10:08 ..
drwxrwxrwx. 3 root root 51 Oct 11 10:08 Crash Reports
drwxrwxrwx. 2 root root 6 Oct 11 10:08 Pending Pings

My selenium test that uses the certificate fails in the way I would expect if there is no certificate in the profile.

Am I leaving out a step somewhere? Would that source .tar.gz file have to be untarred/unzipped first somehow or something?

gknepper · 2019-11-20T18:53:15Z

I would say, first start expanding your 'ffprofile.tar.gz' should have way more then just the cert9.db...

Second.. in your ubuntu machine, delete the .mozilla in your home directory and expand the ffprofile.tar.gz there and test your firefox. If your firefox doesn't work as expected, it's definitely your 'ffprofile.tar.gz' with the wrong content inside.

chrismcmahon · 2019-11-20T19:11:19Z

Yes, my .ffprofile.tar.gz has all the regular .mozilla files and directories plus the changes that I made. The fs in firefox_grid_1 has nothing from there after running 'docker build'. I wonder, I have a grid node and a firefox node, could 'docker build' be updating the wrong docker container?

gknepper · 2019-11-20T19:15:43Z

Did you define a name for your image when you ran the build "docker build -t new_image ." ?

Check with the command "docker image" all images that you may have in your system. I think you're creating a image but starting the container using the old one.

chrismcmahon · 2019-11-20T19:23:26Z

I looked for the string "docker image" and I don't seem to be using it anywhere.

grep -r 'docker image' *
Binary file dockerfilesystem/foo.tar matches
dockerfilesystem/test/bef:docker images selenium
dockerfilesystem/test/before_install_build:docker images selenium
dockerfilesystem/test/before_install_pull:docker images selenium
dockerfilesystem/test/before_install_pull:docker images elgalu/selenium

I'm using a docker-compose.yml file. The firefox image is

firefox:
image: elgalu/selenium
depends_on:
- hub

volumes:

- /dev/shm:/dev/shm

shm_size: 12g
privileged: true
environment:
  - DEBUG=false
  - PICK_ALL_RANDOM_PORTS=true
  - SELENIUM_HUB_HOST=hub
  - SELENIUM_HUB_PORT=4444
  - SELENIUM_NODE_HOST={{CONTAINER_IP}}
  - VNC_FROM_PORT=${VNC_FROM_PORT-40650}
  - VNC_TO_PORT=${VNC_TO_PORT-40700}
  - SCREEN_WIDTH=1300
  - SCREEN_HEIGHT=999
  - VIDEO=${VIDEO-false}
  - GRID=false
  - CHROME=false
  - FIREFOX=true

and ends up being called 'grid_firefox_1'

gknepper · 2019-11-20T19:29:36Z

Check the steps 3 and 4 on this tutorial.

https://www.howtoforge.com/tutorial/how-to-create-docker-images-with-dockerfile/

chrismcmahon · 2019-11-20T19:33:01Z

Thank you! I think I must have missed that Step 3.

docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
39a865d6854c About an hour ago 1.47 GB
docker.io/elgalu/selenium latest cf706845a6b0 5 weeks ago 1.46 GB
docker.io/elgalu/selenium 651da26fe56c 8 months ago 1.47 GB
docker.io/elgalu/selenium 7caa36136e19 10 months ago 1.42 GB
docker.io/elgalu/selenium 53b755899a26 11 months ago 1.41 GB
docker.io/elgalu/selenium da3e011f73cd 12 months ago 1.41 GB
docker.io/elgalu/selenium 3.14.0-p11 38fadc47c25c 13 months ago 1.4 GB

chrismcmahon · 2019-11-20T19:36:32Z

docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
d6c034f6560c elgalu/selenium "entry.sh" About an hour ago Up About an hour grid_firefox_1
bf00c79969b5 elgalu/selenium "entry.sh" About an hour ago Up About an hour 0.0.0.0:4444->4444/tcp, 0.0.0.0:40650-40700->40650-40700/tcp grid_hub_1

chrismcmahon · 2019-11-20T19:41:44Z

I definitely never run any "docker build -t" steps, hmm.

chrismcmahon · 2019-11-20T20:52:21Z

I think I am almost there.

I do 'docker-compose -p grid down'
I do 'docker images'
I don't see anything useful
I do 'docker-compose -p grid up --force-recreate -d'
With my 3-line Dockerfile above I do 'docker build -f Dockerfile -t has_ff_profile .'
I see

Sending build context to Docker daemon 24.03 MB
Step 1/3 : FROM elgalu/selenium
---> cf706845a6b0
Step 2/3 : USER seluser
---> Using cache
---> ee3c3afef1c9
Step 3/3 : ADD ffprofile.tar.gz /home/seluser/
---> Using cache
---> 39a865d6854c
Successfully built 39a865d6854c

Now I see
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
has_ff_profile latest 39a865d6854c 2 hours ago 1.47 GB

(Why does it say '2 hours ago'? I guess because it cached earlier actions...)

I do 'docker-compose -p grid down' again
I do 'docker-compose -p grid up --force-recreate -d' again

In my docker-compose file I change firefox: 'image: elgalu/selenium' to 'image: has_ff_profile'
I do 'docker-compose -p grid down' again
I do 'docker-compose -p grid up --force-recreate -d' again

I run my test that should use the certificate.
I get "Net::ReadTimeout (Net::ReadTimeout)" It seems like Firefox never starts.

I feel like I am really close here.

chrismcmahon · 2019-11-20T21:22:34Z

I am so close:

I created a Dockerfile like this

FROM elgalu/selenium

USER seluser

ADD ffprofile.tar.gz /home/seluser/

RUN cd /home/seluser

USER root

RUN ls .mozilla/firefox

and I see

RUN ls .mozilla/firefox
---> Running in 4875e3a115ca

0pe1dj08.default-release
Crash Reports
installs.ini
Pending Pings
profiles.ini

I wonder if something is wrong with permissions because if I leave out that step "USER root" I get an error "ls: cannot open directory '.mozilla': Permission denied"

docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
68307c0e9ace has_ff_profile_3 "entry.sh" 21 seconds ago Up 20 seconds grid_firefox_1

gknepper · 2019-11-20T22:22:21Z

Create your image again with this Docker file... and yes definitely it's a problem on your ffprofile.tar.gz, mostly permission.

FROM elgalu/selenium
USER root
ADD ffprofile.tar.gz /home/seluser/
RUN chown -R seluser: /home/seluser/.mozilla
RUN ls .mozilla/firefox

chrismcmahon · 2019-11-20T22:44:52Z

almost: I have to switch USER back at the end

FROM elgalu/selenium
USER seluser
ADD ffprofile.tar.gz /home/seluser/
USER root
RUN chown -R seluser: /home/seluser/.mozilla
USER seluser

I'm still not quite there but I am SO CLOSE. :-) Thanks again!

chrismcmahon · 2019-11-27T18:06:14Z

This seems like it should work, and yet I still have a problem:

Using my Firefox profile directory I created on a Ubuntu iso system:

I have a Dockerfile like so:

FROM elgalu/selenium
USER seluser
ADD ffprofile.tar.gz /home/seluser/
USER root
RUN chmod -R 777 /home/seluser/.mozilla
USER seluser
RUN ls -al /home/seluser/.mozilla/firefox/0pe1dj08.default-release

(Note: I tried 'chown -R seluser' first, then 'chmod -R 777' to be certain that permissions were not the problem)

I do 'docker build -f Dockerfile -t has_ff_profile .'

The output from that 'ls -al' command in the Dockerfile shows correctly:

RUN ls -al /home/seluser/.mozilla/firefox/0pe1dj08.default-release
 ---> Running in d96a662b447b

total 12156
drwxrwxrwx. 1 999 999    4096 Nov 19 20:51 .
drwxrwxrwx. 1 999 999    4096 Nov 19 20:49 ..
-rwxrwxrwx. 1 999 999   14298 Nov 19 20:49 addons.json
-rwxrwxrwx. 1 999 999    6760 Nov 19 20:51 addonStartup.json.lz4
-rwxrwxrwx. 1 999 999       0 Nov 19 20:51 AlternateServices.txt
drwxrwxrwx. 1 999 999       6 Nov 19 20:40 bookmarkbackups
-rwxrwxrwx. 1 999 999     216 Nov 19 20:45 broadcast-listeners.json
-rwxrwxrwx. 1 999 999  229376 Nov 19 20:50 cert9.db
-rwxrwxrwx. 1 999 999     162 Nov 19 20:40 compatibility.
etc.

(Note the existence of the 'cert9.db' file in /home/seluser/.mozilla/firefox/0pe1dj08.default-release)

I edit my docker-compose file to point to this image and do 'docker-compose -p grid up --force-recreate -d'

I check that my firefox grid instance is using the correct image

# docker ps
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                                                          NAMES
c62eb84c1e91        has_ff_profile      "entry.sh"          38 seconds ago      Up 37 seconds                                                                      grid_firefox_1
eafdfaeec8b2        elgalu/selenium     "entry.sh"          42 seconds ago      Up 38 seconds       0.0.0.0:4444->4444/tcp, 0.0.0.0:40650-40700->40650-40700/tcp   grid_hub_1

I start my browser in the docker container

@browser = Watir::Browser.new :firefox, marionette: true, acceptInsecureCerts: true, url: "http://0.0.0.0:4444/wd/hub", profile: "default-release"

(Note: I have also tried starting the browser with no profile argument and I get the same result)

I run my test that navigates to the page expecting the certificate:

And the test fails. I took a snapshot of the browser at the point of failure and the browser in the docker container sees the Firefox error page saying "Secure Connection Failed An error occurred during a connection to myhost:myport. SSL peer cannot verify your certificate. Error code: SSL_ERROR_BAD_CERT_ALERT"

As if the browser in the docker container does not have a certificate.

Any suggestions as to what might be wrong would be welcome. I think I've tried everything I can think of.

chrismcmahon · 2019-11-28T19:10:53Z

Update: I took a snapshot of 'about:profiles' page for the Firefox instance in the docker container and it is indeed using 'default-release' and the directory for that is indeed '/home/seluser/.mozilla/firefox/0pe1dj08.default-release'. Why would Firefox not recognize the certificate in that Profile?

gknepper · 2019-11-28T21:53:50Z

My best guess is: the profile that you created was incompatible somehow with the firefox inside the container. My suggestion is enable the VNC in this container and create the file using the internal firefox. I did mine using this technique.

chrismcmahon · 2019-11-29T21:35:14Z

I think I have one last mystery. This time I created my Profile with a certificate and preferences on the latest docker-selenium Firefox Standalone Debug image https://github.com/SeleniumHQ/docker-selenium/tree/master/StandaloneFirefoxDebug. I made a .tar.gz of the .mozilla directory and injected it into my own image with the Dockerfile using the latest image from /elgalu/docker-selenium (both Firefox v.70) and checked that everything looks correct. My test still fails.

Here is the mystery: in the container I took a screen shot of the page at "about:profiles" and I have attached it here.

When I look at my regular normal browser 'about:profiles' page in the Standalone Debug image I see a notice saying "Profile: default-release/This is the profile in use and it cannot be deleted." I also see the page say "Default Profile: yes".

The 'about:profiles' page in the docker container has "Default Profile:no" and I don't see the "This profile is in use..." message.

I've tried building my image with both "RUN chmod -R 777 /home/seluser/.mozilla" and "RUN chmod -R 777 /home/seluser/.mozilla" and I get the same result with either one.

Finally, I tried injecting the '.cache' directory along with the .mozilla directory in the Dockerfile but I get the same result

ADD one_ff_profile.tar.gz /home/seluser/
ADD one_cache.tar.gz /home/seluser/
USER root
RUN chown -R seluser: /home/seluser/.mozilla
RUN chown -R seluser: /home/seluser/.cache
USER seluser

I did not think it was actually possible for Firefox to run with no Profile at all, but that seems to be what is happening in the docker container.

chrismcmahon · 2019-12-01T18:58:00Z

Another take:

I ran the Firefox standalone image (with VNC on port 5901):

$ docker ps
CONTAINER ID        IMAGE                                              COMMAND                  CREATED             STATUS              PORTS                                            NAMES
44f221535a4e        selenium/standalone-firefox-debug:3.141.59-xenon   "/opt/bin/entry_poin…"   47 hours ago        Up 47 hours         0.0.0.0:4444->4444/tcp, 0.0.0.0:5901->5900/tcp   frosty_franklin

I created the Profile I need with the certificate and the preference. I navigated to where I need to go to make sure it works correctly on on the standalone image.

I made the .tar.gz files in the simplest possible Dockerfile

FROM elgalu/selenium

USER seluser

ADD one_ff_profile.tar.gz /home/seluser/
ADD one_cache.tar.gz /home/seluser/

I have a shell on the standalone docker-selenium image and I have a shell on the grid_firefox_1 image. Doing ls -al on the .mozilla directory shows that all permissions are the same for user 'seluser' for all files and directories. The profiles.ini files are identical.

And I still get the problem shown in the image above. The Firefox on the grid_firefox_1 image can see the default-release profile but it is not in use and "Default Profile" is set to "no".

chrismcmahon · 2019-12-02T19:52:36Z

Thanks for all the help! I just now filed an issue against geckodriver with my findings about a copy of a Profile not working mozilla/geckodriver#1662

chrismcmahon · 2019-12-04T19:48:43Z

One more data point: I created a elgalu/docker-selenium grid on a machine where I do have VNC access, made my changes to about:preferences, made a tar.gz file of the .mozilla directory, moved that file to my target system, did the Dockerfile dance. and ran my test that failed in the same way it always fails. The difference with using a elgalu/docker-selenium node instance instead of a docker-selenium Firefox Standalone Debug instance is that I now have a 'default-release' profile set to 'default'. The browser is not using that profile, but previously the browser was not using it AND it was not set to default. Progress...

massinger · 2020-03-24T08:08:45Z

thanks for your great work @gknepper ,config with libnss3-tools works fine for me ,thanks.

XanaDublaKublaConch · 2021-05-19T18:07:38Z

@chrismcmahon Did you ever figure this out? I've got a similar issue. I have my chrome instance up and running perfectly, but firefox is a nightmare with a custom CA. I have a custom docker image that I build, ADD the firefoxprofile.tar.gz that I created in the docker image using VNC, and all of my tests fail with InsecureCertificateException. I'm using the NoVNC option on the selenium firefox node to watch the test and it's obviously not using my profile. If I manually open the ff browser in the VNC session, it defaults to my working profile and I have my custom CA. In python, I can use add_argument with "-profile /home/seluser/.mozilla/profiles/whatever-release' and I see the browser fire up with the correct profile, but the webdriver errors out with a keyerror looking for ['status']. This is maddening!

chrismcmahon · 2021-05-19T18:45:24Z

@XanaDublaKublaConch I never did. I pursued it a long way with the selenium maintainers, and I eventually ended up filing a bug against geckodriver iirc. That was right around the time Moz laid off the whole QA staff, so I doubt that they're interested in fixing it.

XanaDublaKublaConch · 2021-05-19T19:12:01Z

That's disheartening, but thanks for the info!

gknepper · 2021-05-19T20:03:49Z

Hello @chrismcmahon and @XanaDublaKublaConch the solution that I proposed here worked for me =>

#344 (comment)

Please let me know if I can help you somehow.

XanaDublaKublaConch · 2021-05-19T21:18:13Z

Thanks, @gknepper That is essentially what I used and I should have thanked you profusely for that. The chrome custom image works beautifully, but Firefox does not, despite the fact that the profile is there and working manually. I can't use the elgalu/selenium image as a base because I need to use Selenium Grid 4. I'm working in a secure environment and I have to have TLS support on the external hub port (4444), which requires node registration. I'm also trying to figure out how to inject custom headers into the embedded netty server.

I can enable the NoVNC port on the firefox docker image and watch selenium start firefox. It immediately pops up the insecure cert warning. Since the script errors out, the browser stays open and I can look in the cert store of that browser session. My CA is not in the trusted certs. In the same X desktop session, which is running as seluser, I can close the selenium browser session, start firefox from the terminal prompt and it uses the profile from the custom build. From that browser session, I can see my certs in the cert store and I can open sites using that CA as the issue with no problems.

It seems like the geckodriver is either creating a new, temporary blank profile or a temporary copy of the custom profile without the cert store. The weird part is, when the selenium session errors out and I can't see my CA cert, if I go to about:profiles, I still only see the one default profile that should be working.

gknepper · 2021-05-19T22:38:24Z

Hello @XanaDublaKublaConch

First check if issue that you're facing it's actually not a known bug, Check this out: https://bugzilla.mozilla.org/show_bug.cgi?id=1103196

Besides I think this thread can help you out on the certificate on firefox.
https://stackoverflow.com/questions/1435000/programmatically-install-certificate-into-mozilla

As you're not using the elgalu/selenium image it's hard do predict what is involved and how help you more.

My 2 cent, Have fun!

ahuemmer · 2021-06-22T11:28:54Z

Hello @gknepper, @XanaDublaKublaConch and @chrismcmahon,

just wanted to let you know that finally I achieved it alltogether, thanks your last hint @gknepper . 🙂

Here's an example Dockerfile (I know, the way I create the policies.json is quite ugly, but ad hoc I didn't find anything better as heredoc doesn't work in Dockerfiles...)

FROM elgalu/selenium

ARG CERTS_DOWNLOAD_URL=https://my.great.com/pany/certs/certs.tar.gz
ARG FIREFOX_POLICIES_FILE=/etc/firefox/policies/policies.json

USER root

# Install company certificates in system
RUN curl -ksL ${CERTS_DOWNLOAD_URL} -o certs.tar.gz && \
    tar -xzf certs.tar.gz && \
    cp certs/cert/* /usr/local/share/ca-certificates/ && \
    mkdir -p /home/seluser/.mozilla/certificates && \
    mkdir -p $(dirname ${FIREFOX_POLICIES_FILE}) && \
    cp certs/cert/* /home/seluser/.mozilla/certificates && \
    rm -rf certs && rm certs.tar.gz && \
    update-ca-certificates

# Disable chrome update repo and then install necessary tools for cert archive creation
RUN rm /etc/apt/sources.list.d/google-chrome.list && \
    apt -qqy update && \
    apt -qqy --no-install-recommends install \
      libnss3-tools \
      libnss3-1d && \
    apt -qyy autoremove && \
    apt -qyy clean

# Install certs in Firefox
RUN echo "{"  >> ${FIREFOX_POLICIES_FILE} && \
    echo "  \"policies\": {" >> ${FIREFOX_POLICIES_FILE} && \
    echo "    \"Certificates\": {" >> ${FIREFOX_POLICIES_FILE} && \
    echo "      \"ImportEnterpriseRoots\": true, " >> ${FIREFOX_POLICIES_FILE} && \
    echo "      \"Install\": [" >> ${FIREFOX_POLICIES_FILE} && \
    for cert in /home/seluser/.mozilla/certificates/*; do echo "        \"${cert}\"," >> ${FIREFOX_POLICIES_FILE}; done && \
    sed -i '$s/,$//' ${FIREFOX_POLICIES_FILE} && \
    echo "      ]" >> ${FIREFOX_POLICIES_FILE} && \
    echo "    }" >> ${FIREFOX_POLICIES_FILE} && \
    echo "  }" >> ${FIREFOX_POLICIES_FILE} && \
    echo "}" >> ${FIREFOX_POLICIES_FILE}

USER seluser

# Create a nssdb cert archive to be used with chrome. It will contain the company certificates imported earlier, therefore making chrome accept them as valid.
RUN mkdir -p /home/seluser/.pki/nssdb \
    && certutil -d /home/seluser/.pki/nssdb -N \
    && for cert in /usr/local/share/ca-certificates/*; do certutil -d sql:/home/seluser/.pki/nssdb -A -t "CT,C,C" -n $(basename ${cert}) -i ${cert}; done
# To verify, you could issue:  certutil -d sql:/home/seluser/.pki/nssdb -L

CMD ["entry.sh"]

iblfw changed the title ~~I can't add a credentials to firefox or chrome~~ how to add a certificate to firefox or chrome Sep 16, 2019

elgalu added help-wanted question labels Nov 10, 2019

chrismcmahon mentioned this issue Nov 19, 2019

unable to use standalone Firefox profile with Ruby bindings SeleniumHQ/selenium#7796

Closed

chrismcmahon mentioned this issue Dec 2, 2019

Firefox/geckodriver does not recognize copy of Profile mozilla/geckodriver#1662

Closed

how to add a certificate to firefox or chrome #344

how to add a certificate to firefox or chrome #344

Comments

iblfw commented Sep 12, 2019 • edited Loading

gknepper commented Nov 7, 2019

chrismcmahon commented Nov 18, 2019 • edited Loading

gknepper commented Nov 18, 2019

chrismcmahon commented Nov 18, 2019

gknepper commented Nov 18, 2019

chrismcmahon commented Nov 18, 2019

chrismcmahon commented Nov 19, 2019

gknepper commented Nov 19, 2019

chrismcmahon commented Nov 19, 2019

gknepper commented Nov 19, 2019

chrismcmahon commented Nov 20, 2019 • edited Loading

gknepper commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

gknepper commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

volumes:

- /dev/shm:/dev/shm

gknepper commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019 • edited Loading

chrismcmahon commented Nov 20, 2019 • edited Loading

gknepper commented Nov 20, 2019

chrismcmahon commented Nov 20, 2019

chrismcmahon commented Nov 27, 2019

chrismcmahon commented Nov 28, 2019

gknepper commented Nov 28, 2019

chrismcmahon commented Nov 29, 2019 • edited Loading

chrismcmahon commented Dec 1, 2019

chrismcmahon commented Dec 2, 2019

chrismcmahon commented Dec 4, 2019

massinger commented Mar 24, 2020

XanaDublaKublaConch commented May 19, 2021

chrismcmahon commented May 19, 2021

XanaDublaKublaConch commented May 19, 2021

gknepper commented May 19, 2021

XanaDublaKublaConch commented May 19, 2021

gknepper commented May 19, 2021

ahuemmer commented Jun 22, 2021

iblfw commented Sep 12, 2019 •

edited

Loading

chrismcmahon commented Nov 18, 2019 •

edited

Loading

chrismcmahon commented Nov 20, 2019 •

edited

Loading

chrismcmahon commented Nov 20, 2019 •

edited

Loading

chrismcmahon commented Nov 20, 2019 •

edited

Loading

chrismcmahon commented Nov 29, 2019 •

edited

Loading