Support XDG Firefox NSS databases in dev-certs

[danegsta]

Support XDG Firefox NSS databases in dev-certs

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making. If you'd like to propose a new feature or change, please open an issue to discuss the change or find an existing issue.

Support Firefox XDG profiles and typed NSS database overrides

Description

Firefox on newer Linux distributions can store profiles under the XDG configuration directory instead of the legacy ~/.mozilla location. This prevented dotnet dev-certs --trust from finding and updating those NSS databases.

This change moves browser-specific NSS conventions into Firefox and Chromium implementations and adds Firefox discovery under $XDG_CONFIG_HOME/mozilla/firefox with legacy-profile precedence.

NSS database overrides

On Linux, DOTNET_DEV_CERTS_NSSDB_PATHS now supports explicit browser types for each colon-delimited NSS database path:

export DOTNET_DEV_CERTS_NSSDB_PATHS="firefox=/path/to/firefox-profile:chromium=/path/to/chromium-nssdb"

• firefox= applies Firefox NSS semantics, including the C,, trust attributes required by Firefox. This can be used for Firefox-derived browsers such as Zen that keep profiles in custom locations.
• chromium= applies Chromium NSS semantics, including the P,, trust attributes and server-certificate validation behavior.
• Unprefixed paths remain supported for compatibility. Known Firefox profile paths are inferred as Firefox; other paths retain the previous Chromium behavior.
• As before, any non-empty override list replaces automatic NSS database discovery rather than supplementing it.

Coverage includes default and configured XDG paths, legacy precedence, typed and untyped overrides, empty entries, and override replacement. An end-to-end Linux container smoke test also built the in-tree tool, populated real NSS databases, verified matching certificate fingerprints, confirmed Firefox C,, and Chromium P,, trust attributes, and passed --check --trust plus Chromium certutil -V -u V validation.

Resolves #67127

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[Copilot]

🟡 Changes recommended

Fix legacy-profile selection so empty roots fall back to XDG discovery.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/Shared/CertificateGeneration/UnixCertificateManager.cs:1098

• Checking only whether the legacy root exists suppresses XDG discovery even when that root contains no usable *.default* profile. A stale or empty ~/.mozilla/firefox directory therefore makes --trust skip the real XDG profile; select the legacy root only when profile enumeration finds a profile, then fall back to the XDG root.

            var firefoxDirectory = GetLegacyDirectory(homeDirectory);
            if (!Directory.Exists(firefoxDirectory))
            {
                firefoxDirectory = GetXdgDirectory(homeDirectory, xdgConfigHome);
            }

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[danegsta]

Tested by a user on Fedora 44 and verified cert trust works for a default Firefox install and they were able to apply trust to a Firefox fork by setting a DOTNET_DEV_CERTS_NSSDB_PATHS path with the new firefox= prefix to apply the correct trust settings.

[Copilot]

🟢 Approval recommended

The implementation preserves existing behavior while comprehensively covering the new XDG and typed-override paths.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced