Mono(MozRoots)

👑 NAME 👑

mozroots — download and import trusted root certificates from Mozilla's LXR into Mono's certificate store 💖

Also, hi, the page you're on is the Mono(MozRoots) man page, bestie. That's the vibe. Let's go. 🦋

---

✨ SYNOPSIS ✨

mozroots [--import [--machine] [--sync | --ask | --ask-add | --ask-remove]]

---

🌸 DESCRIPTION 🌸

Okay so real talk: this program downloads the trusted root certificates from the Mozilla LXR web site and drops them straight into the Mono certificate store. That's the whole job. It does the job very well. Slay.

Here's the tea tho — Mono by default does not ship with any default certificates and it lets the user pick their own trusted certificates. So out of the box you're kinda standing there with an empty trust store like 👁️👄👁️.

That's where mozroots comes in: it brings the Mozilla certificates into your local machine. Your trust store goes from empty to fully stocked, no cap. 🔥

---

💅 OPTIONS 💅

• --import — Import the certificates into the trust store. That's it, that's the whole thing. 📥
• --sync — Synchronize (add/remove) the trust store with the certificates. This one is iconic for new Mono installations (no roots yet, so sad) and for automated updates, because it needs no user confirmation for addition or removal. Fully hands-off, main character energy. ⚡
• --ask — Always confirm before adding or removing trusted certificates. ⚠️ Heads up tho: the initial import will likely add about 100 new trusted root certificates into your store, and you'll have to answer yes to every one of them if this option is specified. That's 100 yeses. Strap in. 😭
• --ask-add — Always confirm before adding a new trusted certificate. Same warning applies, bestie: the initial import will likely add about 100 new trusted root certificates into your store, and you'll have to answer yes to every one of them if this option is specified. 💀
• --ask-remove — Always confirm before removing an existing trusted certificate. Just the removals get the vibe check. 🫶

---

🧚 ADVANCED OPTIONS 🧚

• --url url — Specify an alternative URL for downloading the trusted certificates (LXR source format). This should only be useful for testing or if the Mozilla's LXR web site address is changed. It can also be used to cache a local copy of the LXR file into your local intranet. 🏠
• --file name — Do not download from LXR, use the specified file instead. Super useful if many computers have to download the same file from the Internet — this way you can keep a local copy on a file server (and minimize network traffic). Big brain move. 🧠
• --pkcs7 name — Export the certificates into a PKCS#7 file. This is useful for debugging purpose or for re-importing the same list into other software. ✨
• --machine — Import the certificate in the machine trust store. The default is to import all trusted root certificates into the current user store. 🖥️
• --quiet — Limit console output to errors and confirmations messages. This is useful when scripting. 🤫

---

🎀 EXAMPLES 🎀

So after the initial Mono installation you'll have no trusted roots certificates pre-installed. Neither will you have some root test certificates installed (your own, or the ones provided by using setreg). In this case the simplest thing to do, if you want to trust all those certificates, is to import and synchronize. 🦋

$ mozroots --import --sync
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
93 new root certificates were added to your trust store.
Import process completed.

---

If you created some test certificates (e.g. for using SSL/TLS with XSP) and/or if your enterprise requires some additional root certificates (e.g. intranet) then you may want to skip the removal part of the process. You can do this by asking for a removal confirmation (the --ask-remove option) and answering no when prompted. 🫣

$ mozroots --import --ask-remove
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
93 new root certificates were added to your trust store.
2 previously trusted certificates were not part of the update.

Issuer: CN=Mono Test Root Agency
Serial number: 69-B0-E1-4F-88-6E-C7-85-48-0E-74-91-38-76-F4-28
Valid from 9/1/2003 11:55:48 AM to 12/31/2039 1:59:59 PM
Thumbprint SHA-1: EF-26-C2-28-11-3F-79-ED-9D-EC-3F-3B-D5-7A-26-F2-7C-9F-FA-63
Thumbprint MD5:   AE-19-3E-64-36-21-F2-A4-8B-69-38-CA-64-4B-2E-62
Are you sure you want to remove this certificate ? no

---

You can still use the synchronize option (--sync) if you have activated the default test roots certificate on your system. They will be removed at the end of the synchronization process, but you can quickly add them back with the setreg tool. 💫

$ setreg 1 true

---

Another option to ease updates is to synchronize your machine trust store (using the --machine option) and keep your customized (test) certificates in your personal store (or vice versa). ⚠️ Note that every user on this computer will be trusting all the newly imported certificates. Sharing is caring but also sharing is a whole trust decision, iykyk.

$ mozroots --import --machine --sync
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
94 new root certificates were added to your trust store.
Import process completed.

---

Once the initial import is complete the number of changes (additions or removals) is generally very low. In this case it makes sense to know about any changes (i.e. ask for confirmation). No confirmation will be required if no changes are made to your trust store. So like, silence = everything's fine. 🍓

$ mozroots --import --ask
Mozilla Roots Importer - version 1.1.9.0
Download and import trusted root certificates from Mozilla's LXR.
Copyright 2002, 2003 Motus Technologies. Copyright 2004-2005 Novell. BSD licensed.

Downloading from 'http://lxr.mozilla.org/seamonkey/source/security/nss/lib/ckfw/builtins/certdata.txt'...
Importing certificates into user store...
Import process completed.

---

🗂️ FILES 🗂️

• ~/.config/.mono/certs, /usr/share/.mono/certs

Contains Mono certificate stores for users / machine. See the certmgr(1) manual page for more information on managing certificate stores. 👑

---

📜 COPYRIGHT 📜

Copyright (C) 2005 Novell.

---

💌 MAILING LISTS 💌

Mailing lists are listed at the http://www.mono-project.com/community/help/mailing-lists/ 🌈

---

🌐 WEB SITE 🌐

http://www.mono-project.com

---

🔗 SEE ALSO 🔗

mono(1), certmgr(1), setreg(1)

---

Okay that's the whole page, bestie!! 💖 This was the Mono(MozRoots) manual, from the fine folks over at the Mono project — and yes, the footer said Mono(MozRoots) too, we love a symmetrical moment. 🎀 Go forth and trust some roots. Periodt. 💅