to create a clean profile, but not start firexox after that. Just note the location of the profile directory.
I think that you should name it "default" since it's going to be used by many users.
Copy the cert8.db from the profile you want to the newly created profile.
Then start firefox with the new profile
firefox -P newprofile
and visit the ssl site you want. If everything is OK it will not ask you to accept the certificate.
Then you can copy that profile in user's homedir in the image you want to create