“With Firefox version 68, when a TLS connection error occurs, Firefox automatically enables the Enterprise Roots preference [ie. Importing any root CA installed at OS level] and attempts to connect again. If the issue is resolved, then the Enterprise Roots preference remains enabled.”
Option added to circumvent dirty antiviruses 😒
https://support.mozilla.org/en-US/kb/how-disable-enterprise-roots-preference