Mozilla advises Firefox users to update if they want browser add-ons to keep working

[Alfonso Maruccia]

In context: Root certificates are an essential element for modern browser security. They protect users by verifying signed web pages, extensions, and other types of content. However, developers must update root certificates constantly; otherwise, the root of the trust chain breaks, and everything goes down the drain.

Mozilla is reminding Firefox users that a necessary root certificate expires soon and that older browser versions could become a security and usability nightmare in a few months. Starting March 14, 2025, Firefox versions older than 128 (ESR 115.13) containing the expired certificate will likely cause "significant" issues with add-ons, content signing, and streaming of DRM-protected media.

Failing to update Firefox before next March means losing features relying on remote functionality. Many installed add-ons will become disabled, and other systems that require content verification could also break. The issue affects Firefox editions for Android and Windows operating systems, including Windows, macOS, and Linux. Those with iPhone or iPad versions of Firefox should be okay.

Mozilla's FAQs explain that a root certificate authenticates browser content as trusted. When a certificate expires, Firefox cannot verify content anymore. The newest versions of Firefox and other Mozilla software using the same root-of-trust model include a new root certificate that will prevent the expiration issue in March 2025.

Mozilla is likely trying to prevent the chaos experienced by Firefox users in 2019 when an expired certificate suddenly borked many instances of the open-source browser. Today's Firefox market share is much lower than five years ago, but we're still talking about millions of users potentially becoming vulnerable to the expiration issue.

Some add-on developers have expressed concern over how Mozilla is managing the problem. One developer said Firefox should clearly state what could happen on all the affected platforms. Otherwise, disgruntled users could direct their complaints directly to add-on programmers. One-star review bombing campaigns after the certificate expires could also be part of the deal.

Mozilla advises users to update to Firefox 128 on each device with the browser installed, which is the best practice to avoid this and other issues. The latest release always provides significant performance improvements and important security fixes. Mozilla released Firefox 128 and ESR 115.13 on July 9, 2024, so there have been minor incremental updates since then. The most current version is Firefox 131.0.3.

Permalink to story:

Mozilla advises Firefox users to update if they want browser add-ons to keep working

 

[bviktor]

It takes considerable, deliberate effort to prevent Firefox from auto-updating itself, so if someone does that, I don't feel sorry for them at all.

 

[kiwigraeme]

Used to be my main browser on an older PC. just checked see noscript is still around and can be added to Chrome and chromium based browsers. My Browser forgets all it's cookies etc on a refresh. apparently same for noscript , so could be annoying to re-engage for things you don't want it working on

 

[Win7user]

I wouldn't mind paying $100, $125 a bucks a year for FF to keep updating Firefox for Win 7.

 

[NotYourITguy]

I wouldn't mind paying $100, $125 a bucks a year for FF to keep updating Firefox for Win 7.

Windows 7 doesn't support modern TLS versions either so even if firefox were to support older Windows versions, a good portion of the internet will be unusable for you regardless.

 

[trgz]

It takes considerable, deliberate effort to prevent Firefox from auto-updating itself, so if someone does that, I don't feel sorry for them at all.

One simple registry entry if my memory serves me (though mine isn't disabled from updating now) - it was a lot easier than the amount of work to arrange the tabs and address bar correctly...

 

[Brickwizard]

Mozilla advises users to update

Thanks to the Linux updating system, found in most distributions, I have been running FF 131.0.3 for the last few days,
Although this is an advisory for Fire Fox, If You're a Windows user it applies to all applications [programs] not bundled in your installation that you have downloaded direct, I have seen so many systems where critical add on's [firewalls, antivirus and, etc] have been years out of date.
[apart from close friends and family, I no longer get involved in fixing broken windows software, I will do hardware repairs though]

 

[Shalimar]

I wouldn't mind paying $100, $125 a bucks a year for FF to keep updating Firefox for Win 7.

It can be built from source to run on w7 easily enough for those of us wanting. Such

You will need to update TLS as well. Here is a starter

https://www.minitool.com/news/enable-tls-1-2-windows-10-11-7.html

V1.3 can be done as well as needed though it is slightly more work

And contrary to what some foolishly think a upto date current secure w7 is not only doable its not a s hard as many would think

 

[Shalimar]

Windows 7 doesn't support modern TLS versions either so even if firefox were to support older Windows versions, a good portion of the internet will be unusable for you regardless.

Ah incorrect yet again

Honestly should do some basic research b4 making such claims

Start here

https://www.minitool.com/news/enable-tls-1-2-windows-10-11-7.html

 

[NotYourITguy]

Ah incorrect yet again

Honestly should do some basic research b4 making such claims

Start here

https://www.minitool.com/news/enable-tls-1-2-windows-10-11-7.html

TLS 1.2 is not recommended for use by NIST. TLS 1.3 is the current version. Baked in Windows functions rely upon the kernel supported version.

 

[Win7user]

Windows 7 doesn't support modern TLS versions either so even if firefox were to support older Windows versions, a good portion of the internet will be unusable for you regardless.

Well, now that's a bummer...

 

[RaXelliX]

One simple registry entry if my memory serves me (though mine isn't disabled from updating now) - it was a lot easier than the amount of work to arrange the tabs and address bar correctly...

Not sure about any registry entries but with modern 131 version the only way to properly do it is to create folder named distribution in "%ProgramW6432%\Mozilla Firefox" and in there create policies.json file with the appropriate setting. In my case I have disabled automatic updates but manually checking it initiates the update:
{
"policies": {
"ManualAppUpdateOnly": true
}
}

 

[trgz]

Not sure about any registry entries but with modern 131 version the only way to properly do it is to create folder named distribution in "%ProgramW6432%\Mozilla Firefox" and in there create policies.json file with the appropriate setting. In my case I have disabled automatic updates but manually checking it initiates the update:
{
"policies": {
"ManualAppUpdateOnly": true
}
}

I think it was this:

• in HKEY_CURRENT_USER\SOFTWARE\Policies\Mozilla\Firefox (create this if necessary)
• create a 32-Bit DWORD value DisableAppUpdate and give it a value of 1

 

[ZedRM]

Windows 7 doesn't support modern TLS versions either so even if firefox were to support older Windows versions, a good portion of the internet will be unusable for you regardless.

As mentioned by other users, that is completely incorrect info.