Import ublue.local root certificate into browser

[tepene]

As described in #12 , it would be nice if the ublue.local root certificate could be imported automatically into the system default browser. Might be cumbersome and complex to implement since it should cover all kinds of browsers, installed in all kids of ways (flatpak, distrobox etc.)

If anyone knows how to do this with ansible or bash or something else, let me know or PR it. 😉

[acheron1502]

Did a bit of digging on this...

• You can add custom certs to Fedora's system CA Trust, but browsers may not use that directly
• Chrome and derivatives seem to use: $HOME/.pki/cert9.db
• Firefox seems to use same file in different location: $HOME/.mozilla/firefox/*.default-release/cert9.db

Found this blog link that contains a bash script to add a custom cert to all of these databases under the ROOT directory.

You may need to tweak the find commands a bit depending on if you are going to add any browsers to the system layer or just the user layer.

References

• https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/linux/cert_management.md
• #69 User certificates save when closing Chrome flathub/com.google.Chrome#150
• https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l167 (persists the whole .mozilla directory)
• flathub/com.microsoft.Edge@eeff73b

[tepene]

thanks @acheron1502 for the input and all the references