What are the pki folders in profiles?

[WJFV]

Hello,

the default Firefox profile contains the following lines:

noblacklist ${HOME}/.pki
noblacklist ${HOME}/.local/share/pki
mkdir ${HOME}/.pki
mkdir ${HOME}/.local/share/pki
whitelist ${HOME}/.pki
whitelist ${HOME}/.local/share/pki

As far as I understand, it has something to do with encryption certificates.

Can somebody explain what would happen if I delete these lines from the profile? I just try to get a better understanding.. Thanks!

[glitsj16]

As far as I understand, it has something to do with encryption certificates.

Correct, PKI or Public Key Infrastructure is part of what web browsers use to check Certificate Authorities. In plain language, it is part of the HTTPS or SSL connection protocol. Mozilla keeps a detailed set of documents on MDN that you could consult for the nitty-gritty.

Can somebody explain what would happen if I delete these lines from the profile?

If you remove those lines the paths will not be accessible by your firejailed firefox. It's a bit harder to explain what that might imply for your web browsing experience/security when you decide to drop them. That would depend on what's actually inside those dirs. Personally, before considering blacklisting them, I would check if these dirs actually exist on your machine, what's inside and check the permissions. Being security-related it would surprise me if you find anything world-readable in there. If you do, that should trigger your secops alarm bells :-)

As always, there's only one way to find out... I wouldn't expect (much) breakage, as most of the PKI-related files are installed system-wide by packages like ca-certificates{,-mozilla}, nss, openssl and the likes (or at least they should be if you use your package management system to install and update stuff). Keep us in the loop on what your experiences are, interesting question.