Disable Enterprise Roots in Waterfox

Waterfox has a built-in certificate authority store and, on supported systems, can also trust root certificates installed in the operating system. The security.enterprise_roots.enabled preference controls that operating-system trust. It is enabled by default and may be required by an organization, antivirus product or network security tool that inspects encrypted connections.

Turning the preference off can cause certificate errors on sites that rely on a locally installed root. Only disable it when you understand why the certificate was installed and no longer want Waterfox to trust it.

Stop automatic recovery after certificate errors

The security.certerrors.mitm.auto_enable_enterprise_roots preference allows Waterfox to enable Enterprise Roots after certain certificate errors that indicate intercepted TLS traffic. To prevent that automatic recovery:

1. Enter about:config in the address bar and press Enter.
2. If a warning page appears, select Accept the Risk and Continue.
3. Search for security.certerrors.mitm.auto_enable_enterprise_roots.
4. Use the toggle button to set the preference to false.

Stop importing operating-system roots

To stop Waterfox from trusting supported root certificates in the operating system store:

1. On the about:config page, search for security.enterprise_roots.enabled.
2. Use the toggle button to set the preference to false.
3. Restart Waterfox if a connection does not immediately reflect the change.

An enterprise policy can lock either preference. If the value is locked, only the device administrator can change it.

---