Added call to mozroots to update certs: mozroots --import --sync --machine