How to use https on localhost in Firefox
Use https on localhost in Firefox by importing rootCA.pem from the data\ca folder of Server by Zaweba, since Firefox keeps its own certificate list.
Firefox keeps its own list of trusted certificate authorities, so https on localhost needs one extra step there. With Server by Zaweba, import the file rootCA.pem from Server's data\ca folder into Firefox as a trusted authority. After that, every local site you've given HTTPS opens in Firefox without a warning.
Edge and Chrome use the Windows list of trusted authorities, which Server can add its own authority to with one command. Firefox doesn't read that list, which is why a site can look fine in Chrome and still show a security warning in Firefox. It isn't a fault in the site. Firefox simply hasn't been told about the authority yet.
Before you import anything
Make sure the site has HTTPS. In Server's sites list each site has an HTTPS switch; turning it on makes Server create its local certificate authority, if it hasn't already, and a certificate for that site covering name.test, www.name.test and name.localhost. The site card then shows the https address.
You can do this for as many sites as you like. They're all signed by the same local authority, which is the point: trust the authority once and every site it signs is trusted with it.
Finding rootCA.pem
The authority's file is rootCA.pem, and it lives in the ca folder inside Server's data folder. You don't need to dig for it. Settings has a button that opens the certificates folder, and Settings also lists Server's three main folders if you want to see where everything is kept.
Leave the file where it is. Firefox copies what it needs when you import it.
Importing it into Firefox
Open Firefox's settings, go to the privacy and security section and find the certificates area, where you can view certificates. On the tab for authorities, choose to import, pick rootCA.pem, and when Firefox asks what to trust it for, tick the option to trust it to identify websites. Confirm, and close the settings.
Now open your site's https address. If a tab was already showing the warning, reload it. Firefox should show the page with its usual padlock.
If you use more than one Firefox profile, each profile has its own list, so repeat the import in each one you develop with.
Doing Edge and Chrome at the same time
While you're at it, use Tools, then Trust the local HTTPS certificate authority in Server (it's also a button in Settings). Server explains what it's going to do and then adds the authority to your own Windows Trusted Root store; Windows shows its own prompt to confirm. That covers Edge and Chrome, and with Firefox done by hand, all three browsers agree.
If Firefox still warns
Check the address first. The certificate covers name.test, www.name.test and name.localhost, so any other name won't match. If Server moved HTTPS to a different port because the usual one was busy, use the exact address on the site card, port included.
Check you imported the file as an authority rather than as a certificate for a single site, and that the website trust option was ticked. Importing it under the wrong tab is the most common slip.
The site certificates are valid for 825 days. That's long enough that you'll rarely think about it, but if a very old site starts warning again one day, its certificate may simply have run out.
Keeping it safe
The authority is made on your PC, for your PC. Everything Server runs listens on 127.0.0.1, so the sites it signs can't be reached from anywhere else. Keep the certificates folder private all the same: don't copy it into a site folder or upload it to a web host.
Once Firefox trusts the authority, local HTTPS in Server by Zaweba behaves just like a real site, which makes it easier to test anything that only works over https, such as secure cookies.
