AdGuard does not automatically import CA for Firefox

[Morku]

AdGuard version

7.12

Browser version

Firefox 109.0.1

OS version

Windows 11, 22H2, Build 22621.1105

What filters do you have enabled?

No response

What Stealth Mode options do you have enabled?

No response

Support ticket ID

No response

Issue Details

the issue:

1. Install Firefox
2. Install AdGuard 7.10 or newer
3. Start Firefox and browse a page with HTTPS (e.g. google.com)
4. -> Firefox is stuck at MOZILLA_PKIX_ERROR_MITM_DETECTED certification issue and does not automatically continue

The opposite case where it is fine:

1. Install Firefox
2. Install AdGuard 7.9.1 or lower
3. Start Firefox and browse a page with HTTPS (e.g. google.com)
4. you get a short certification error notification, but Firefox automatically import and continues browsing -> all fine

Expected Behavior

no issue with AG 7.9.1 and below:

2023-02-04_13-40-51.mp4

Screenshots

stuck at vertification error starting with AG 7.10 and higher:

2023-02-04_13-46-06.mp4

Additional Information

No response

[Aydinv13]

@Morku
Please check if this problem remains after the following steps:

1. Open FF and paste about:config to address bar
2. Click on Accept the Risk and Continue
3. Paste security.enterprise_roots.enabled into a preference name field
4. Click on Toggle to set True value (if it's already True, then press False and True again)
5. Restart FF and reproduce your issue

[Morku]

@Aydinv13

This fix the issue.

The thing is, AdGuard 7.9.1 and below automatically set security.enterprise_roots.enabled to True. Starting with 7.10 AdGuard doesn't do that anymore.

It could be:

1. a bug
2. a wanted behavior, because of insert a reason here

If 2. is the case than:

What is the recommended way to use AdGuard for Windows and Firefox nowadays?

2.1 = set security.enterprise_roots.enabled manually?
2.2 = Import cert.cer from https://local.adguard.org/cert?

Even if Bug or wanted behavior, the user is left alone without a reason whats going on. You install AdGuard, open Firefox and you are stuck at certification error. There is no manual after installation of AdGuard what to do. You have to research of your own. Technical unskilled users won't understand.

[Aydinv13]

@Morku
The thing is that Firefox used to use the system certificate store but now it seems that the logic has been changed.
We're already working on the problem, thank you.

[adbuker]

can be related to #4592

[Morku]

@adbuker
It's another issue even if both are related to Firefox only. Thats the only similarity.
This issue exist since version 7.10. The other issue is a new with version 7.12.

The "stuck Firefox process" issue even happen, if you don't import the certificate/set security.enterprise_roots.enabled

[adbuker]

@Morku , yes I see, the reason is quiet obvious indeed. "Relation" I meant in terns of cross-effects, which these issue lead to