I just did a little googling, and it appears that Firefox supports group policy settings that can cause it to use system root certs[1], so if it's not working, it may be because the domain administrators haven't bothered to support it.
1: https://github.com/mozilla/policy-templates/blob/f972ec60de7...
In No to Chromemozilla
policy-templates
Python2018–2026
mozilla / policy-templates
policy-templates
Policy Templates for Firefox
32Distinct people
32Mentions
1Explicit recommenders
1.3KGitHub stars
What to know before exploring
What it is
Policy Templates for Firefox
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
They very well could do this for a company that requires really strict privacy and security, but unfortunately in its current state Firefox doesn't have nearly the corporate…
4oo4 used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:03:30 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year32 dated mentions
Observed mentions: 2018-06-21 03:24:05 UTC to 2026-10-13 18:49:05 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Firefox Policy Templates
NoteThese policies are in active development and may contain changes that do not work with current versions of Firefox.
Use the officially released versions if you are deploying changes.
This repository contains policy templates to support deploying and managing Firefox as an enterprise browser.
Firefox policies allow administrators to centrally manage browser behavior, enforce security requirements, configure features, or disable certain functionality.
Policies are commonly used in enterprise or managed environments such as businesses, schools, and public-sector organizations.
Policy documentation
WarningDocumentation for policy behavior and syntax is moving to Firefox Admin Docs.
The new docs repository is public and open to contributions, so if you want to make improvements, feel free to contribute at https://github.com/mozilla/enterprise-admin-reference.
See the GitHub Discussion for more information.
Read the full README on GitHubWhat Hacker News says
6 sourcesAdditionally (for Mozilla, not sure about chrome) there are a couple of checks to allow system administrators to force Firefox to fall back to the system DNS if desired. Either they can return NXDOMAIN (or some other options) to queries for use-application-dns.net, or they can use the usual group policy/active directory/policies.json methods to configure users' Firefox to not use DoH or use their internal DNS server with DoH if supported.
https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
https://support.mozilla.org/en-US/kb/customizing-firefox-usi...
https://github.com/mozilla/policy-templates/blob/master/READ...
In Windows will improve user privacy with DNS over HTTPSFor intranet/companies you should use Group Policies to install extensions: https://github.com/mozilla/policy-templates#extensions
In Firefox to Discontinue Sideloaded ExtensionsFirefox 60 was the first release with official Group Policy support [1]. Starting from version 64 you could also configure Firefox for macOS using configuration profiles [2].
Both the ADMX templates for Windows and preference .plist for macOS are available from GitHub [3]. The full list of configurable preferences can be found on SearchFox.org [4].
As of Firefox 67 there are quite a lot of settings that can be managed now. Certainly enough for Firefox to be deployed in enterprise environments.
There was also a really interesting talk at MacADUK 2019 by Mike Kapley on the work Mozilla has done so far to support enterprise deployment [5].
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433136
[2] https://github.com/mozilla/policy-templates/blob/master/mac/...
[3] https://github.com/mozilla/policy-templates
[4] https://searchfox.org/mozill
Read the rest
So two things. The MSI installer will convert a local (EXE) installation to a global install (updating shortcuts and removing the local profile install whilst preserving the chrome profile).
Second, Firefox does have ADMX policies (ADMX being used primarily after Vista): https://github.com/mozilla/policy-templates. I believe it took them so long because they were initially reluctant, user freedom etc. But I guess Chrome's success in enterprise made them reconsider. Honestly I never considered Firefox for our Windows Domain because of the lack of Group Policy support. Now I deploy both and users have options :)
In Google to restrict modern ad blocking Chrome extensions to enterprise users> I replied sub-thread, but adding here to give some more visibility
> to some of the issues DoH is causing and will cause:
>
> I work at a k12 school and I am involved on many k12 IT communities.
>
> Some schools already removed Firefox from the students computers
> because it was being used as a "VPN" by some elementary students
> to access porn - at school. Guess what this VPN was? Just DNS over HTTPS.
Firefox now has enterprise support where the administrator can force all desktops to use certain Firefox settings including enabling/disabling/configuring DoH.
See
https://www.mozilla.org/en-US/firefox/enterprise/
And here's a link to details for configuration DNS over HTTPs.
https://github.com/mozilla/policy-templates/blob/master/READ...
(I work at Mozilla)
In DNS-over-HTTPS Policy Requirements for Resolvers