This is consistent with our treatment of this information in private browsing mode, where the ability to add permanent exceptions is disabled. This would be a trivial fix if there were a function on nsICertOverrideService to clearAll(), but should also be easy enough using GetAllOverrideHostsWithPorts and then clearing each one in sequence.

(In reply to comment #0) > This would be a trivial fix if there were a function on nsICertOverrideService > to clearAll(), but should also be easy enough using > GetAllOverrideHostsWithPorts and then clearing each one in sequence. Except that, apparently, GetAllOverrideHostsWithPorts is not yet implemented. http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/public/nsICertOverrideService.idl So less trivial, but hopefully still straightforward enough.

AFAICT, we don't want to delete all of the exceptions; only the exceptions added during the time period for which we are clearing history.