anchor.diff:          # which is why it will not use the system certificate store for the time being.
           # firefox
           chromium
  -        falkon
  +        qutebrowser
           midori
         ];
       };
  
positive.code:     with subtest("Unknown CA is untrusted in curl"):
          machine.fail("curl -fv https://bad.example.com")
  
      browsers = [
        # Firefox was disabled here, because we needed to disable p11-kit support in nss,
        # which is why it will not use the system certificate store for the time being.
        # "firefox",
        "chromium",
        "falkon",
        "midori"
      ]
      errors = ["Security Risk", "not private", "Certificate Error", "Security"]
  
      machine.wait_for_x()
      for browser, error in zip(browsers, errors):
          with subtest("Good certificate is trusted in " + browser):
              execute_as(
                  "alice", f"env P11_KIT_DEBUG=trust {browser} https://good.example.com & >&2"
              )
              wait_for_window_as("alice", browser)
              machine.wait_for_text("It works!")
  
negative.code:             execute_as("alice", "xdotool key ctrl+w")  # close tab
  
          with subtest("Unknown CA is untrusted in " + browser):
              execute_as("alice", f"{command} https://bad.example.com & >&2")
              machine.wait_for_text(error)
              machine.screenshot("bad" + browser)
              machine.succeed("pkill " + browser)
  