How import SSL cert in Tor Browser? In Firefox I import my self signed cert in Setting -> Advanced -> Certificates -> Authorities. In TB I can't add cert as in FF, because if I add a cert it is not added.

I copy profiles from FF to TB, but nothing happends. TB ignores the certificates database (cert8.db, key3.db) from my profile. Any ideas?

  • Problem sloved by changing in about:config Dec 20, 2016 at 19:44
  • security.nocertdb true -> false If you use sekf signed SSL cert, generated with option -sha256 , change also security.pki.sha1_enforcement_level 2 -> 0 (not recommended by) or regenerate with -sha512. Dec 20, 2016 at 19:49
  • Which system? If you've solved the problem, please post it as an answer.
    – kenorb
    Dec 21, 2016 at 13:19

1 Answer 1


The OP gave the answer in the comments. I'll add the answer for completeness:

Tor Browser has set security.nocertdb in about:config to true. This means that the intermediate certificate store is only in memory. If you change this value to false, it will be possible to add new certificates.

  • IMHO it can be a possibility for data leak and fingerprinting. The possible attack vector is: using custom certs we can trick browser to load ssl-ciphered content with a client certificate previously imported. Also there's a possibility to elaborate JS and try to open different HTTPS urls and see if it will be valid, and if it will be - then the cert imported can indicate a group of users at least. For second attack vector we need multiple "import me" SSL certificate spots. But it's just a hypothetical screinario
    – Alexey Vesnin
    Jan 20, 2017 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.