diff --git a/bubble-server/src/main/java/bubble/model/device/BubbleDeviceType.java b/bubble-server/src/main/java/bubble/model/device/BubbleDeviceType.java
index 77f1caaa..36622e12 100644
--- a/bubble-server/src/main/java/bubble/model/device/BubbleDeviceType.java
+++ b/bubble-server/src/main/java/bubble/model/device/BubbleDeviceType.java
@@ -20,6 +20,7 @@ public enum BubbleDeviceType {
     ios           (CertType.pem),
     android       (CertType.cer),
     linux         (CertType.crt),
+    firefox       (CertType.crt),
     other         (null);
 
     @Getter private CertType certType;
diff --git a/bubble-server/src/main/java/bubble/resources/account/AuthResource.java b/bubble-server/src/main/java/bubble/resources/account/AuthResource.java
index 35279820..d6cedc55 100644
--- a/bubble-server/src/main/java/bubble/resources/account/AuthResource.java
+++ b/bubble-server/src/main/java/bubble/resources/account/AuthResource.java
@@ -20,6 +20,7 @@ import bubble.model.cloud.BubbleNode;
 import bubble.model.cloud.BubbleNodeKey;
 import bubble.model.cloud.NetworkKeys;
 import bubble.model.cloud.notify.NotificationReceipt;
+import bubble.model.device.BubbleDeviceType;
 import bubble.model.device.Device;
 import bubble.server.BubbleConfiguration;
 import bubble.service.account.StandardAuthenticatorService;
@@ -468,16 +469,23 @@ public class AuthResource {
     @Produces(CONTENT_TYPE_ANY)
     public Response getCaCert(@Context Request req,
                               @Context ContainerRequest ctx,
+                              @QueryParam("deviceType") BubbleDeviceType deviceType,
                               @QueryParam("type") CertType type) {
         final Account caller = optionalUserPrincipal(ctx);
         if (type == null) {
-            final String remoteHost = getRemoteHost(req);
-            if (!empty(remoteHost)) {
-                final Device device = deviceIdService.findDeviceByIp(remoteHost);
-                if (device != null) {
-                    type = device.getDeviceType().getCertType();
+            if (deviceType != null) {
+                type = deviceType.getCertType();
+            } else {
+                final String remoteHost = getRemoteHost(req);
+                if (!empty(remoteHost)) {
+                    final Device device = deviceIdService.findDeviceByIp(remoteHost);
+                    if (device != null) {
+                        type = device.getDeviceType().getCertType();
+                    }
                 }
             }
+        } else if (deviceType != null) {
+            type = deviceType.getCertType();
         }
         if (type == null) type = CertType.pem;
         final BubbleNetwork thisNet = configuration.getThisNetwork();
diff --git a/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties b/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
index 3903b09e..a7f80d2a 100644
--- a/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
+++ b/bubble-server/src/main/resources/message_templates/en_US/server/post_auth/ResourceMessages.properties
@@ -437,10 +437,12 @@ button_label_mitm_enable=Enable
 button_label_mitm_disable=Disable
 
 message_download_ca_cert=Download Certificate
-message_os_apple=Apple
-message_os_windows=Windows
+message_os_macosx=Apple Mac OS X
+message_os_ios=Apple iOS
+message_os_windows=Microsoft Windows
 message_os_android=Android
 message_os_linux=Linux
+message_os_firefox=Firefox Browser (desktop)
 
 loading_apps=Loading apps...
 table_title_apps=Apps
diff --git a/bubble-web b/bubble-web
index 70da8e0d..2da83c23 160000
--- a/bubble-web
+++ b/bubble-web
@@ -1 +1 @@
-Subproject commit 70da8e0d38be1ea90edc33784e94a8d5435f8ac5
+Subproject commit 2da83c231b0a07b723ba60e33e2e1a540311cceb