Overview
If you use Swif Browser Security in Firefox, Swif adds a certificate to Firefox. This article explains what it's for, where it's installed, and what does and doesn't depend on it. It's for IT and security teams who find the certificate, and want to understand it.
Summary
Question | Answer |
What is it? | A certificate for |
What is it for? | An encrypted connection between Swif Browser Security in Firefox and the Swif agent, on the same device |
Where is it installed? | In Firefox's own certificate store only. It isn't added to the operating system's trust store, such as |
How is it installed? | Through the Firefox extension policy, which installs Swif Browser Security in Firefox |
Is it needed to enroll the device, or for the agent to work? | No. Only Firefox features of Swif Browser Security need it. |
Does the Swif installer add it? | No. The installer only downloads the agent, enrolls the device, and starts the agent. |
What the certificate is for
Swif Browser Security talks to the Swif agent on the same device, for features such as:
showing device information and compliance status in the browser
reading local accounts, to reset passwords
checking that new passwords meet your password policy
self-service app installs
Firefox requires this connection to be encrypted. So the agent offers an encrypted local connection at tryswif.com, and Firefox trusts it through this certificate.
tryswif.com stays on the device. Swif maps tryswif.com to 127.0.0.1 in the device's hosts file. The connection never leaves the device, and Firefox isn't contacting a website.
Firefox only. Other browsers connect to the agent without this certificate.
Where it's installed, and how it's kept up to date
Item | Details |
Firefox's certificate store | The certificate is added here, through the Firefox extension policy. |
Operating system trust store | Not changed. On Linux, the agent doesn't modify |
Keeping it current | The Swif agent checks Firefox's certificate store when it starts, and every 100 minutes. If the certificate is missing, it adds it back. |
Check that Firefox trusts it: in Firefox, go to Settings > Privacy & Security > Certificates > View Certificates, open the Authorities tab, and look for Swifteam Root CA.
What happens without it
Without the certificate | Result |
Enrollment, device management, and the agent's connection to Swif | Not affected |
Swif Browser Security in other browsers | Not affected |
Swif Browser Security in Firefox | Features that need the agent don't work, such as device information, compliance status, password reset, and self-service app installs. Firefox may show connection errors, or Swif may report that Firefox isn't managed. |
Do I need it?
You use Swif Browser Security in Firefox: yes. Keep the Firefox extension policy assigned.
You don't use Firefox, or don't use Swif Browser Security in Firefox: no. Don't assign a Firefox extension policy with Swif Browser Security turned on.
Troubleshooting
Firefox shows connection errors, or Swif says Firefox isn't managed
Check that the Firefox extension policy is assigned to the device, with Swif Browser Security turned on.
Check that Swifteam Root CA is in Firefox's Authorities tab.
Restart Firefox. If the certificate was missing, the agent adds it back within 100 minutes, or when it next starts.
The certificate isn't in the system's trust store
This is expected. The certificate is installed only in Firefox's certificate store, not in the operating system's.