An enhancement is required to fix bug 1400293.
Firefox must be able to distinguish between Mozilla-CA roots and other locally installed roots.
The necessary enhancement to p11-kit has been suggested upstream at
This bug requests to pick up this change in Fedora, after the changes have been added to upstream NSS and p11-kit projects.
Fixed in p11-kit 0.23.4