title: How do you get Mozilla FireFox to accept your root Certificate Authority ssl cert so it doesn't complain about self-signed ssl certs on https?
body: <p>First I want to point out that this works fine with Internet Exporer 11. But for some reason I just can't get FireFox to play nice! </p>
  
  <p>So I already added my own rootCA security certificate and under Internet explorer it works fine and my website with self-signed cert is trusted.</p>
  
  <p>But on Firefox v61.0.1 and also v65.0 even though my root certificate is already added, and in addition security.enterprise_roots.enabled is set to true (in about:config), I still get the "your connection is not secure" message and I have to add a security exception just to view my site. </p>
  
  <p>In the area with the message and button to add exception, Firefox says:</p>
  
  <p>"xx.xxx.xx.x uses an invalid security certificate. The certificate is only valid for xx.xxx.xx.x. Error code: SSL_ERROR_BAD_CERT_DOMAIN"</p>
  
  <p>Now the xx.xxx.xx.x is an internet reachable IP address and both instances in the above line have exactly the SAME IP address, I've used IP for the CN field.</p>
  
  <p>clicking on SSL_ERROR_BAD_CERT_DOMAIN shows:
  "Unable to communicate securely with peer: requested domain name does not match the server’s certificate. HTTP Strict Transport Security: false HTTP Public Key Pinning: false Certificate chain: -----BEGIN CERTIFICATE----- ......."</p>
  
  <p>Anyway, I am guessing that in its current configuration, Mozilla FireFox is CONFUSED that the site has an invalid certificate when in fact it is valid and the reason for its confusion is perhaps it expects a domain-NAME not IP address.</p>
  
  <p>If so, is there a way I can tell Firefox to honor IP Address based ssl certs?</p>
  
  <p>Again, current config is working perfectly fine with Internet Explorer for me.</p>
  
  <p>As you know many tools like built-in IDE svn and other source control clients really do not like it when there's something to complain about in an ssl-cert.</p>
  
  <p>That's the reason I went through trouble of creating and loading own Root CA Authority in windows. And no please do not recommend letsencrypt, needs renew often and I don't have incoming OPEN ports which it seems to require to renew.</p>
  
  <p>thx!</p>