... and the answer is apparently: Firefox shot itself into its certificate cache file. rm -rf ~/.firefox ~/.cache/firefox fixes it.