The problems here are: 1. Using baked-in CA TLS certs which leads to trialware/expireware. 2. Setting up a support thread than closing it right before the problem happens so as to avoid feedback on 1. (3. Setting up the CA TLS system requriement for extensions/add-ons in the first place except in specially negotiated situations like Debian's "Firefox" and the unbranded builds; neither of which has this problem)
The solution going forwards is obviously to have replaceable certs. But Mozilla doesn't seem very open to feedback as evidenced by the actions this link points to.