[Freeipa-users] Debian client browsers don't trust root cert after ipa-client-install

Hello, Thanks to this group's help, I'm learning my way through IPA's certificate system. I read Fraser's well written post on creating sub-CAs, and successfully got everything to work. I then ran into the same problem Kevin Vasko hit in this thread: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho... It seems Debian-based Chrome and Firefox don't implicitly trust the OS root certificate store. For each Firefox profile (about:profiles), the NSS db is in ~/.mozilla/firefox/<profile>. The certs in this directory can be listed certutil -d sql:/home/nick/.mozilla/firefox/4sar5x5s.default-release/ -L On Ubuntu 18.04, after installing and configuring IPA client (# ipa-client-install --mkhomedir), the IPA certificate is listed in the store. Still, Firefox doesn't trust the IPA server or its trusted hosts. Why??? It's been established that Linux Firefox and Linux Chrome don't trust the OS trusted certificate stores. It seems, with all that comes with assumptions, that Firefox doesn't trust its own profile store, either. Nick