diff --git a/lib/firefox-db2pem.sh b/lib/firefox-db2pem.sh
index 629a2e8d64a0e2..46b135bf6e1307 100644
--- a/lib/firefox-db2pem.sh
+++ b/lib/firefox-db2pem.sh
@@ -24,14 +24,14 @@
 # It extracts all ca certs it finds in the local Firefox database and converts
 # them all into PEM format.
 #
-db=`ls -1d $HOME/.mozilla/firefox/*default*`
+db="ls -1d $HOME/.mozilla/firefox/*default*"
 out=$1
 
 if test -z "$out"; then
   out="ca-bundle.crt" # use a sensible default
 fi
 
-currentdate=`date`
+currentdate=$(date)
 
 cat >$out <<EOF
 ##
@@ -43,11 +43,11 @@ cat >$out <<EOF
 EOF
 
 
-certutil -L -h 'Builtin Object Token' -d $db | \
+certutil -L -h "Builtin Object Token" -d $db | \
 grep ' *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$' | \
 sed -e 's/ *[CcGTPpu]*,[CcGTPpu]*,[CcGTPpu]* *$//' -e 's/\(.*\)/"\1"/' | \
 sort | \
-while read nickname; \
+while read -r nickname; \
  do echo $nickname | sed -e "s/Builtin Object Token://g"; \
 eval certutil -d $db -L -n "$nickname" -a ; \
 done >> $out