DEV Community

Weather Clock Dash
Weather Clock Dash

Posted on

Firefox in Corporate Environments: SSL Inspection, Proxy Config, Enterprise Policies, and Kerberos

#firefox #sysadmin #security #enterprise

Developers working in corporate environments face specific Firefox challenges: proxy settings, SSL inspection, certificate authorities, locked-down IT policies, and sometimes having to use an IT-managed browser. Here's how to navigate common enterprise Firefox scenarios.

Corporate SSL Inspection (The HTTPS Interception Problem)

Many corporate networks use SSL inspection — the corporate proxy terminates your TLS connection and re-establishes it with the server, allowing the proxy to read and filter HTTPS traffic.

How to tell if you're behind SSL inspection:

  1. Visit any HTTPS site
  2. Click the lock icon → Connection Secure → More Information → View Certificate
  3. If the issuer is your company (or a company like Zscaler, Blue Coat, etc.) instead of DigiCert, Let's Encrypt, etc. — you're behind SSL inspection

Firefox's behavior: Firefox has its own certificate trust store (separate from the OS). Corporate CA certificates added to Windows/macOS certificate store are NOT automatically trusted by Firefox.

Fix: Your IT team needs to push the corporate CA certificate to Firefox. This can be done via:

  • Firefox enterprise policy (CCK2 or policies.json)
  • Manual: Settings → Privacy → Certificates → View Certificates → Import
  • Command: about:config → security.enterprise_roots.enabled = true → Firefox uses OS certificate store

Set enterprise_roots.enabled via policies.json (more reliable):

{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Corporate Proxy Configuration

Automatic proxy (PAC file):
Settings → General → Network → Settings → Automatic proxy configuration URL → enter your PAC file URL

WPAD autodiscovery: Firefox can discover proxy via WPAD if Use system proxy settings is selected and your network broadcasts the WPAD URL.

Manual proxy:
Settings → Network → Settings → Manual proxy configuration

  • HTTP Proxy: proxy.corp.com:8080
  • Also check "Use this proxy server for all protocols" if that's what your IT requires

No proxy for:
Add internal hostnames that should bypass the proxy: localhost, 127.0.0.1, *.corp.internal

Proxy authentication: Firefox will prompt for credentials on first use. Save them to avoid re-entering.

Firefox Policies (Enterprise Deployment)

IT admins can manage Firefox via policies.json. On macOS/Linux, this file goes in specific locations:

/etc/firefox/policies/policies.json         # Linux
/Library/Application Support/Mozilla/policies/policies.json  # macOS
C:\Program Files\Mozilla Firefox\distribution\policies.json  # Windows
Enter fullscreen mode Exit fullscreen mode

Common policy examples:

{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    },
    "ExtensionSettings": {
      "uBlock0@raymondhill.net": {
        "installation_mode": "force_installed",
        "install_url": "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"
      }
    },
    "Homepage": {
      "URL": "https://intranet.corp.com",
      "Locked": true
    },
    "BlockAboutConfig": false,
    "DNSOverHTTPS": {
      "Enabled": true,
      "ProviderURL": "https://doh.corp.com/dns-query"
    },
    "OverrideFirstRunPage": "",
    "DisableTelemetry": true
  }
}
Enter fullscreen mode Exit fullscreen mode

View active policies: about:policies shows all policies currently applied to your Firefox.

Self-Signed Certificates on Internal Sites

Corporate internal sites often use self-signed certificates or certificates from an internal CA.

Adding an exception (one-time):
When Firefox shows a security warning on an internal site:

  1. Click "Advanced"
  2. Click "Accept the Risk and Continue"
  3. This adds a permanent exception for that hostname

Better approach (import the internal CA):
Settings → Privacy → Certificates → View Certificates → Authorities tab → Import → import your internal CA certificate

After importing, all sites signed by that CA are trusted.

Firefox Under ZScaler/Proxy with TLS Inspection

ZScaler is a common corporate proxy. Firefox + ZScaler setup:

  1. Get the ZScaler root CA certificate from IT (or download from your ZScaler portal)
  2. Settings → Privacy → Certificates → View Certificates → Import
  3. Trust it for "Websites"
  4. Restart Firefox

Alternative (if IT doesn't provide the cert):
about:config → security.enterprise_roots.enabled = true
Firefox will then use the Windows/macOS trust store, which ZScaler's IT admin has already updated.

Using Firefox in a Developer VM or Docker

Running Firefox in a containerized dev environment:

Docker headless Firefox:

FROM ubuntu:22.04
RUN apt-get update && apt-get install -y firefox-esr xvfb
# Run with Xvfb for headless display
CMD ["sh", "-c", "Xvfb :99 -screen 0 1280x720x24 & DISPLAY=:99 firefox --headless"]
Enter fullscreen mode Exit fullscreen mode

With Playwright (for testing):

const { firefox } = require('@playwright/test');
const browser = await firefox.launch({ headless: true });
Enter fullscreen mode Exit fullscreen mode

Profile preservation in Docker:
Mount a volume for the Firefox profile:

docker run -v /host/firefox-profile:/root/.mozilla/firefox/default my-image firefox
Enter fullscreen mode Exit fullscreen mode

Multiple Firefox Profiles for Corporate/Personal Separation

If you use one machine for work and personal:

  1. about:profiles → Create New Profile → name it "Work"
  2. Work profile: work email, corporate proxy configured, work extensions
  3. Personal profile: personal accounts, no proxy
  4. Both can run simultaneously in separate windows

Shortcut to open a specific profile:

firefox -P "Work" &
firefox -P "Personal" &
Enter fullscreen mode Exit fullscreen mode

On macOS:

/Applications/Firefox.app/Contents/MacOS/firefox -P "Work"
Enter fullscreen mode Exit fullscreen mode

NTLM/Kerberos Authentication

Corporate intranets often use Windows authentication (NTLM or Kerberos).

Firefox Kerberos/NTLM (automatic authentication to intranet sites):

In about:config, add your intranet domains to the trusted URIs list:

network.negotiate-auth.trusted-uris = .corp.com,.internal.example.com
network.automatic-ntlm-auth.trusted-uris = .corp.com,.internal.example.com
Enter fullscreen mode Exit fullscreen mode

Once configured, Firefox automatically uses your Windows/Kerberos credentials for those domains without prompting.

Telemetry and Privacy in Corporate Firefox

If you're configuring Firefox for employees and want to disable telemetry:

Policy to disable:

{
  "policies": {
    "DisableTelemetry": true,
    "DisableFirefoxStudies": true,
    "DisableFeedbackCommands": true,
    "DisableFormHistory": true
  }
}
Enter fullscreen mode Exit fullscreen mode

Or via about:config:

  • datareporting.healthreport.uploadEnabled = false
  • toolkit.telemetry.enabled = false

Developer Tools in Corporate Firefox

DevTools work normally even in managed Firefox, unless IT specifically blocked about:devtools-toolbox via policy.

If DevTools is blocked by policy: IT has specifically disabled it, and you'll need to request an exception or use a personal device.

Remote debugging through corporate proxy:
The DevTools remote debugging protocol uses WebSocket connections, which may need to be whitelisted in your corporate proxy for debugging Android devices over USB.

Quick Checklist for Corporate Firefox Setup

  • [ ] security.enterprise_roots.enabled = true if corporate CA isn't already trusted
  • [ ] Add corporate CA certificate via Certificates import if using manual setup
  • [ ] Configure proxy settings (auto or manual)
  • [ ] Add internal domains to NTLM/Kerberos trusted URIs
  • [ ] Create separate Work profile if using same machine for personal
  • [ ] Check about:policies to see what IT has locked

Top comments (0)