I feel like repetition in here: built-in browser in PR1.2 works with any certificate that you want if you use acmcli to add CA's (always used commandline, but UI should work too).

For UI to work, you should place the wanted root CA.pem files in /home/user directory and when you select security->certificates->"add new certificate" it should show a list of pem files in /home/user and let you install wanted certs, and then you can choose if if you want that to work with websites/wlan/mail/software.

I just added my self-signed https pages to be fully trusted on my device. And now browser is not warning about untrusted cert anymore, and everything works smoothly.

I don't know how external firefox application handles certs, as I haven't used that application myself.

You should not put your hopes in possible PR releases, as feature freeze for new functionality was already long time ago. But certification UI should work, most people just don't know that the path for imported .pem files is /home/user.

PS. for example for startssl.com certificates to start to work you do: # apt-get install wget; cd /home/user; wget http://www.startssl.com/certs/sub.class1.server.ca.pem; # And then install it from the UI