diff --git a/lib/freeipa.pm b/lib/freeipa.pm
index 9f6113d0..067ffb80 100644
--- a/lib/freeipa.pm
+++ b/lib/freeipa.pm
@@ -43,7 +43,13 @@ sub start_webui {
     assert_script_run "sed -i -e 's,enable_xauth=1,enable_xauth=0,g' /usr/bin/startx";
     disable_firefox_studies;
     type_string "startx /usr/bin/firefox -width 1024 -height 768 https://ipa001.domain.local\n";
-    assert_screen ["freeipa_webui_login", $user_screen], 30;
+    assert_screen ["freeipa_webui_login", $user_screen, "firefox_certificate_error"], 30;
+    if (match_has_tag "firefox_certificate_error") {
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=1530429
+        record_soft_failure "Certificate validation error - likely Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=1530429";
+        assert_and_click "firefox_refresh";
+        assert_screen ["freeipa_webui_login", $user_screen], 30;
+    }
     wait_still_screen 5;
     # softfail on kerberos ticket bugs meaning we get auto-logged in
     # as the requested user when we don't expect to be
diff --git a/needles/firefox/firefox_refresh-20190225.json b/needles/firefox/firefox_refresh-20190225.json
new file mode 100644
index 00000000..8588e912
--- /dev/null
+++ b/needles/firefox/firefox_refresh-20190225.json
@@ -0,0 +1,16 @@
+{
+  "area": [
+    {
+      "xpos": 75,
+      "height": 22,
+      "ypos": 43,
+      "type": "match",
+      "width": 22
+    }
+  ],
+  "properties": [],
+  "tags": [
+    "browser_refresh",
+    "firefox_refresh"
+  ]
+}
diff --git a/needles/firefox/firefox_refresh-20190225.png b/needles/firefox/firefox_refresh-20190225.png
new file mode 100644
index 00000000..b53fc334
Binary files /dev/null and b/needles/firefox/firefox_refresh-20190225.png differ