A Burp Suite certificate in Firefox is what lets the proxy read your HTTPS traffic without throwing security warnings on every page. Firefox keeps its own certificate store instead of using the operating system’s, so importing Burp’s CA certificate here is a separate step from anything you have set up elsewhere on Linux.
Before you start: confirm the proxy listener is active
Every step below assumes Burp’s proxy listener is already running, since the certificate export and the Firefox import both depend on it. Open Burp and check:
- Proxy > Options, or Proxy > Options > Proxy Listeners on newer versions
- An entry for
127.0.0.1:8080with the Running checkbox ticked
If that checkbox is off, requests never reach Burp and Firefox has nothing to import a certificate from in the first place. Community and Professional editions both use the same listener setup and the same certificate format, so nothing below changes based on which one you’re running.
Creating A Directory To Store Our Certificate
Before we set up Burpsuite with Firefox, we need to create a folder to store Burp’s CA Certificate which we would be exporting later. To do this, I suggest creating a hidden directory in the user’s home folder to store the certificate.
Let’s create a hidden folder with the mkdir command:
$ mkdir .burpsuite
We would later store Burp’s CA Certificate here!
Exporting Burp’s CA Certificate
Burp’s CA Certificate is required while testing websites with HTTPS. To export the Certificate, open Burpsuite and go to Proxy > Options.
Also, note the interface Burpsuite is listening on, which in this case is 127.0.0.1:8080, as this will come handy later on.
Next up, click “Import/export CA certificate“. This should open up a prompt with Export Options.
We’ll be exporting the Certificate in DER format. Store it in the hidden folder previously created. Save it as “BurpCert.der” so that we can identify it easily later on.
$ ls
BurpCert.der
Downloading the certificate from Burp’s welcome page
There’s a second way to grab the certificate that skips the hidden folder step. With Burp running and Firefox already pointed at the proxy, open a new tab and visit:
http://burpsuite
You should land on a “Welcome to Burp Suite” page with a CA Certificate link top right. Clicking it saves the same DER file to Downloads. Burp generates a fresh certificate per install, so this page only loads once Firefox is routed through the proxy. Older write-ups point to http://burp instead, which still works in some setups, but current documentation uses http://burpsuite.
Setting Up Burpsuite With Firefox
Next up, we need to import Burp’s CA Certificate which we previously exported. To do so, go back to Firefox’s Settings and from there go to Privacy & Security.
Scroll down to the Certificates section and click View Certificates. In the Certificate Manager that opens, switch to the Authorities tab, since the certificate needs trusting as a Certificate Authority, not storing under “Your Certificates.”
Click Import and select the certificate we exported earlier. You’ll be asked which trust settings to apply. Check only “This certificate can identify websites” and click OK, leaving the email-trust box unchecked since Burp’s certificate has nothing to do with signing email.
With this, we should have Burp’s CA Certificate imported. You can even find it listed in your certificate list as follows:
Firefox keeps this list in its own NSS certificate store rather than reading the Linux system trust store, a Mozilla design choice that predates most other browsers doing the same. That is also why importing the certificate here has no effect on curl, wget or any tool running outside the browser, a point we come back to further down.
Configuring Firefox To Use BurpSuite Proxy
For the setup to be able to intercept the requests sent by the Browser we need to configure Firefox so as to use Burp’s Proxy. To do so open Firefox’s Network setting, which you can do by going to Firefox’s Settings and, in the search box, typing “proxy”. This should bring up the Network Settings.
Open the Proxy Settings, which should give you the following window:
Select Manual Proxy configuration and in the fields provided, enter the address Burp is listening on as we previously noted. In the default case it is as follows:
- HTTP Proxy: 127.0.0.1
- Port: 8080
Select the checkbox to also use this proxy for HTTPS and click OK. Leave the SOCKS fields empty, since Burp listens as a plain HTTP proxy and setting a SOCKS host here routes your traffic somewhere Burp is not listening. Firefox also dropped its FTP proxy field entirely once it removed built-in FTP support back in Firefox 90, so do not worry if you remember an FTP box from older screenshots and cannot find it now. Now, all the requests issued by Firefox can be intercepted by Burpsuite.
Intercepting Requests With Burpsuite
If you now open Burpsuite -> Proxy and turn on Intercept, you’ll see your request being intercepted and now you can modify them to your will! Visit any HTTPS site, such as https://example.com, and confirm Firefox shows no certificate warning, that is your sign the import worked. If your requests aren’t intercepted, make sure that the Proxy settings are the same as in Burp’s listening address.
Trusting Burp’s certificate at the system level on Linux
Importing the certificate into Firefox only covers Firefox. If you also want to route curl, a Python script or another CLI tool through Burp’s proxy, that tool reads the Linux system trust store instead of Firefox’s NSS store, so it needs the certificate trusted separately.
On Debian and Ubuntu, convert the DER file to PEM and drop it into the local certificate directory:
$ openssl x509 -in BurpCert.der -inform DER -out burp.pem -outform PEM
$ sudo cp burp.pem /usr/local/share/ca-certificates/burp.crt
$ sudo update-ca-certificates
On Fedora or RHEL, the certificate goes into the trust anchors directory and the equivalent command is update-ca-trust extract instead. Either way, the file needs a .crt extension for the update command to pick it up. Once that’s done, a quick curl -v https://example.com through Burp’s proxy should complete without a certificate error, confirming the system trust store picked up the change. Our guide to verifying SSL certificates with shell scripts covers more of what the openssl command can do with certificates beyond this one conversion step.
Troubleshooting Burp Suite certificate errors in Firefox
Most certificate errors trace back to one of a few causes:
- SEC_ERROR_UNKNOWN_ISSUER on an HTTPS site almost always means the certificate was never imported, or landed under the wrong tab in Certificate Manager instead of Authorities
- Forgetting to restart Firefox after import, since the browser caches trust decisions for the session
- A stale certificate from a reinstalled or migrated Burp instance, since Burp generates a fresh certificate each time and Firefox keeps trusting the old one until it is removed (see the next section)
- HSTS on some sites, a policy that forces a browser to only ever load them over HTTPS, which can block Burp’s certificate on Chrome even after a correct import, though Firefox tends to be more forgiving here
Testing on a mobile device follows a similar import flow, but needs the certificate copied onto the device and its Wi-Fi proxy pointed at Burp separately, which sits outside a Firefox-only setup.
Removing Burp’s CA certificate from Firefox
Reinstalling Burp, switching machines or cleaning up an old test certificate all call for the same steps:
- Go back to View Certificates > Authorities
- Select the PortSwigger CA entry and click Delete or Distrust
- Confirm with OK, then restart Firefox
Removing the old certificate first matters most when Burp has regenerated its CA certificate since your last install, since Firefox never clears an old entry on its own just because a new one gets imported.
Key Takeaways
- Firefox uses its own NSS certificate store, separate from the Linux system trust store
- Export Burp’s CA certificate in DER format from Proxy > Options, or via http://burpsuite
- Import the certificate under Certificate Manager’s Authorities tab, not Your Certificates
- Check only “This certificate can identify websites” when prompted for trust settings
- Firefox’s manual proxy setup no longer has an FTP field, since Firefox 90 dropped FTP
- Leave the SOCKS host blank, since Burp listens as a plain HTTP proxy
- Trusting the certificate system-wide for CLI tools needs a separate openssl and update-ca-certificates step
- Remove the old PortSwigger CA entry before importing a freshly regenerated certificate
Frequently Asked Questions
Why does Firefox still show a certificate warning after I import Burp’s CA certificate?
Firefox caches trust decisions per session, so a restart is usually required. Also confirm the certificate was imported under the Authorities tab, not Your Certificates.
Does importing Burp’s certificate in Firefox also trust it for curl or other terminal tools?
No. Firefox uses its own certificate store. Terminal tools read the Linux system trust store, which needs the certificate added separately with update-ca-certificates.
What is the difference between http://burp and http://burpsuite for downloading the certificate?
Both can work depending on your Burp version, but Burp’s current documentation uses http://burpsuite. Try that first if the shorter address does not load.
Do I need to select SOCKS v5 when configuring Firefox’s proxy for Burp Suite?
No. Burp’s default proxy listener is a plain HTTP proxy on 127.0.0.1:8080, so the SOCKS host field should stay empty.
Why is there no FTP proxy field in Firefox’s manual proxy settings anymore?
Firefox removed built-in FTP protocol support entirely in Firefox 90, released in 2021, which also removed the FTP proxy field from the settings page.
Can I use Burp Suite with Firefox without installing the CA certificate at all?
Only for plain HTTP sites. Any HTTPS site shows certificate warnings, or refuses to load, until Burp’s CA certificate is trusted in Firefox.