https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox says that the certs are in cert9.db, key4.db, and secmod.db in the profile directory. I haven't sussed out what format they're in or how to add entries, just that some certs that I've added appear in there.

It looks to me as though Firefox locks its sqlite files, so it might not be possible to update certs while Firefox is running.