SecurityDevices

Add or delete PKCS #11 modules.

A PKCS #11 module is an external library that lets Firefox talk to a cryptographic device such as a smart card or hardware token, so that certificates and keys on that device can be used for client authentication. The SecurityDevices policy loads those libraries instead of requiring the user to manage them manually from the Security Devices dialog in Settings.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 64	Available since 60.4.0	Available since 149

The Add and Delete form was added in Firefox 114, Firefox ESR 102.12. Earlier versions map a device name directly to its module path (see legacy SecurityDevices implementation for details).

CCK2 Equivalent: N/A
OMA-URI: SecurityDevices
Preferences Affected: N/A

Examples

policies.json

{
  "policies": {
    "SecurityDevices": {
      "Add": {
        "A Device": "/path/to/library/for/device"
      }
    }
  }
}

policies.json

{
  "policies": {
    "SecurityDevices": {
      "Delete": [
        "A Device"
      ]
    }
  }
}

policies.json

{
  "policies": {
    "SecurityDevices": {
      "A Device": "/path/to/lib",
      "Another Device": "/path/to/another/lib"
    }
  }
}

JSON schema

SecurityDevices JSON schema

{
  "type": "object",
  "patternProperties": {
    "^(?!Add$|Delete$).*$": {
      "type": "string"
    }
  },
  "properties": {
    "Add": {
      "type": "object",
      "patternProperties": {
        "^.*$": {
          "type": "string"
        }
      }
    },
    "Delete": {
      "type": "array",
      "items": {
        "type": "string"
      }
    }
  }
}

Values

• Add maps a device name to the full path of the module library on disk. The name is what the device is listed as in Firefox, and the path must be readable on the machine where Firefox runs.
• Delete is a list of device names to unload, using the name the module was added under. Removing a name that is not loaded is not an error.

Windows (GPO)

Software\Policies\Mozilla\Firefox\SecurityDevices\Add\NAME_OF_DEVICE_TO_ADD = PATH_TO_LIBRARY_FOR_DEVICE
Software\Policies\Mozilla\Firefox\SecurityDevices\Delete\1 = NAME_OF_DEVICE_TO_DELETE

macOS

<dict>
  <key>SecurityDevices</key>
  <dict>
    <key>Add</key>
    <dict>
      <key>NAME_OF_DEVICE_TO_ADD</key>
      <string>PATH_TO_LIBRARY_FOR_DEVICE</string>
    </dict>
    <key>Delete</key>
    <array>
      <string>NAME_OF_DEVICE_TO_DELETE</string>
    </array>
  </dict>
</dict>