Troubleshooting

Find solutions to common issues when using FireTail.

Firefox reports certificate errors on macOS

If Firefox reports certificate errors when accessing an AI provider monitored by the FireTail Endpoint Agent, it may not be trusting the FireTail root CA from the macOS System Keychain.

Why this happens

Firefox 120, released on November 21, 2023, enabled automatic trust of third-party root certificates in the operating system store by default on macOS and Windows. Earlier versions may need this enabled manually. Check the version currently running and its certificate settings. See the Firefox 120 release notes.

Firefox has supported importing roots from the macOS System Keychain since version 63. On older versions, the security.enterprise_roots.enabled preference may be set to false. The issue can also occur on newer versions if automatic trust has been disabled. See Mozilla's certificate import documentation and automatic certificate trust guidance.

Enable system certificate trust

First, confirm that the FireTail CA is installed and trusted on the Mac using the manual installation or managed deployment instructions. Enabling this Firefox setting does not install a missing FireTail CA.

For Firefox 63 or later on macOS:

1. Open Firefox and enter about:config in the address bar.
2. If a caution prompt appears, click Accept the Risk and Continue.
3. Search for security.enterprise_roots.enabled.
4. If its value is false, click the toggle icon to change it to true. If it is already true, leave it enabled.
5. Restart Firefox and open the affected website again.

Firefox will trust eligible root certificates from the macOS System Keychain. These certificates may not appear in Firefox's Certificate Manager; manage their trust through macOS. If the preference is locked by your organization's browser policy, ask your administrator to enable system certificate trust.