Firefox Users Beware: Expiring Certificate Threatens Add-Ons and DRM Services

At a glance

• Mozilla’s Expiring Certificate: A Mozilla root certificate used to sign add-ons and other content expired on March 14, 2025.
• Pervasive Impact: Anyone running Firefox older than version 128, or ESR older than 115.13, could lose add-ons and DRM video playback.
• Critical Response Needed: The fix is simple: update Firefox.
• Broader Security Implications: Old browsers also stop getting security fixes, so an update is overdue anyway.

Update Firefox or lose your add-ons

Mozilla warned Firefox users in early March 2025 that a root certificate used to sign add-ons and other Mozilla content would expire on March 14. Users on older versions risked having their extensions disabled and DRM-protected streaming break. Newer versions were fine. They already include the replacement certificate, so the problem is outdated browsers, not a flaw in Firefox itself.

What the certificate does

Mozilla uses this root certificate to verify that add-ons and some other content come from Mozilla and haven’t been tampered with. It’s a signature check.

Once the old certificate expired, Firefox versions that didn’t have the new one could no longer verify signed add-ons and related components. Mozilla said Firefox 128 or later, and ESR 115.13 or later, include the updated certificate, and anyone still on an older build has also been missing months of security fixes that close holes attackers already know how to use.

What breaks without the update

Mozilla listed these effects for outdated versions:

• Add-Ons Disruption: Installed add-ons can be disabled and new ones can’t be installed, because Firefox can’t verify their signatures.
• DRM-Related Challenges: DRM-protected streaming on video and music services can stop working.

Who has to do what

The fix falls on a few groups:

• Mozilla Corporation: Rolled out the new certificate in recent versions and warned users ahead of the deadline.
• Service Providers: Streaming services and add-on developers may need to point affected users to an update.
• Cybersecurity Experts: IT teams should check for old Firefox installs, including ESR builds on managed machines.

Why certificates expire

Certificates expire on purpose. That limits how long a stolen or weakened key can be abused, and expiry only causes trouble when software isn’t updated to trust the replacement.

How to fix it

Users and administrators should take these steps:

• Immediate Certificate Renewal: Update to Firefox 128 or later, or ESR 115.13 or later, through Help > About Firefox.
• Public Awareness Campaigns: Help less technical relatives and coworkers check their browser version.
• Certificate Tracking: Companies need to track certificate expirations across their own systems so they get ahead of similar deadlines.

A five-minute fix

Firefox’s expiring certificate is a minor event with an easy fix. Update the browser and the add-ons come back. The bigger lesson is for IT teams, because certificate expirations are predictable and should be on a calendar long before they break something users depend on.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.