Push a Certificate Authority Certificate to Firefox with ZENworks

The other day on the internal mailing lists one of the technical sales team asked how you could deploy a CA certificate to Firefox using ZENworks. A little quick googling yielded this :


So I decided to start there and build a bundle that would deploy certificates through ZENworks. Thought I’d share with anyone else looking to do this:

Process to build the bundles

In order for you to push a CA certificate to Firefox, you’ll need the following software:

  • Download and extract the vbscript from here firefoxpush.

  • Your certificate authority certificate file.


Once you’ve downloaded this software you are ready to build the bundles. To keep things clean you’ll want to build two bundles:

  • Visual C 2010 SP1 x86 Installer

  • Push Firefox Bundle

Visual C 2010 SP1 x86 Installer

The first bundle you need to create is the one that installs the Visual C 2010 SP1 x86 redistributable. This is required by the NSS Tools that will actually be used to push the certificate.

  1. Run the “vcredist_x86.exe –x” command. This should prompt you for a folder where you want to place the extracted contents of the executable package. Enter the path to an empty directory.

  • Create a new bundle that distributes the vc_red.msi.

    1. In ZCC, go to the Bundle page and browse to the folder you want to create the bundle in; then select New > Bundle…

  • Select Windows Bundle

  • Select MSI Application

  • In the name field enter Deploy Visual C 2010 x86 Libraries; then click Next.

  • Click the browse button next to Upload .msi for normal install.

  • Browse to the vc_red.msi and select Include all files in and below the directory of this file

  • When the files are finished uploading, click Next.

  • At the Select Command screen, click Next.

  • Select the option to view additional details; then click Finish.

  • Add system requirements and impersonation settings to the action so that the MSI is only installed IF it is not already present on the device.

    1. Select the Actions tab.

  • Select the Install sub-tab.

  • Click the Install MSI action in the list.

  • Click the Advanced tab.

  • Select Run as secure system user.

  • Select the Requirements tab.

  • Select Architecture = 32

  • Click Add Filter

  • Select Registry Key and Value exists.

  • In the first text box enter HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x86

  • In the second text box enter Installed

  • In the dropdown box select No.

  • Click Add Filter Set.

  • Select Architecture = 64

  • Click Add Filter

  • Select Registry Key and Value exists.

  • In the first text box enter HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\VisualStudio\10.0\VC\VCRedist\x86

  • In the second text box enter Installed

  • In the dropdown box select No.

  • Click OK.

  • Click Apply to save the bundle.

You now have a bundle that will install the Visual C 2010 Runtime to any assigned machines.

Push Firefox Bundle

The second bundle will actually push the certificate to Firefox. If you wanted you could probably use a different bundle to deploy the NSS tools, if you see yourself needing multiple certificate push bundles. But for the purposes of this solution, I’ve created a single bundle that both deploys the tools and pushes the certificate.

  1. Create a new empty Windows bundle called Push Firefox Certificate.

  • Go to the details of the bundle.

  • Select the Actions tab.

  • Select the Install tab.

  • Select Add > Install Bundle.

  • Enter a name for the action; then browse to and select the Deploy Visual C x86 Libraries bundle you created.

  • Click OK.

  • Select Install Directory.

  • Enter an action name, and then for the Source Directory browse to and select the directory where you have the NSS Tools package extracted to.

  • In the Destination Directory field, enter ${TOOLS_PATH}

  • Set the Copy option to Copy if Newer.

  • Click OK.

  • Select Add > Install File(s).

  • Enter a name, then click Add.

  • Click Add and browse to your certificate file.

  • In the Destination Directory enter ${TOOLS_PATH}

  • Set the Copy option to Copy if Newer

  • Click OK.

  • Select Add > Run Script.

  • Enter an action name.

  • In Script to Run, select Define your own script.

  • Click Edit next to script content.

  • Paste the contents of the vbs file you downloaded with this solution.

  • In the Script extension field, select .vbs

  • Click OK.

  • Click Apply. The bundle actions should be similar to those shown below:FirefoxBundle

  • Select the Settings tab.

  • Select System Variables.

  • Click Add.

  • Enter CA_NAME as the variable name and the nickname of the certificate that you want to be added into the system as the value.

  • Click OK.

  • Click Add.

  • Enter CERT_FILE as the variable name and the file name of your certificate file as the value (jus the filename, not the full path).

  • Click OK.

  • Click Add.

  • Enter TOOLS_PATH as the variable name and the path where you want the NSS Tools to be deployed as the value.

  • Click OK.

  • Click Apply to save the changes. The variable should be similar to those shown below:VariablesFirefox

You should now be able to assign this bundle to a device running Mozilla Firefox and have it execute on that device. Doing so should result in the certificate being added. It is important to note that Firefox cannot be running in order for this to work. You could optionally add an action to kill the firefox process as the first action in the bundle. I have not done this because I don’t want to stop people’s browsers. You could also handle this by prompting the user to make sure Firefox isn’t running when this runs.

Subscribe to these Bundles from ZENguru

If you are using ZENworks 11SP3 or later, you can save yourself the time associated with building these bundles, and simply subscribe to the ZENguru zone that I maintain and then choose to subscribe for this bundle. You can find out more information about how to subscribe to the zone by reading https://www.novell.com/communities/coolsolutions/zenguru-cool-solutions-zone/

Once you’ve subscribed to the bundles, you’ll be alerted of issues. These issues are related to the fact that the bundles use a number of variables. Set the values you want to use and you should be good to go. As always you should replicate these bundles to sandbox and test them on your test devices before deploying them in production.


How To-Best Practice
Comment List
Related Discussions