Your director of IT needs to be told to stand up a single CA for the entire organization and use that CA for all in house sites that you don't want to spend money on. That way you can include that CA in your deployment of FF, IE, Java, or whatever else supports Certificates. Problem solved.

Sounds to me like the problem is not one that FF caused but more appropriately, that your organization did not utilize PKI appropriately to begin with. FF as well as IE has always notified the user if the CA was not trusted they just finally made it so that the user can't simply click the "I'm an idiot" / "OK" button.