MOZILLA_PKIX_ERROR_MITM_DETECTED in Firefox: How to Fix It

MOZILLA_PKIX_ERROR_MITM_DETECTED is a Firefox certificate error shown on a page titled "Software is Preventing Firefox From Safely Connecting to This Site". It means Firefox could not build a trusted chain for the site's certificate (an unknown-issuer failure) and the issuer of that certificate matches the issuer Firefox already saw when one of its own connections to Mozilla was intercepted.

The mechanism is a canary. When Firefox's update check fails with SEC_ERROR_UNKNOWN_ISSUER, or when a certificate error page triggers a probe to mitmdetection.services.mozilla.com that fails the same way, Firefox stores the intercepting issuer's name in the preference security.pki.mitm_canary_issuer. From then on, an unknown-issuer error whose issuer equals that name is reported as MITM_DETECTED. In other words: something on this computer or network re-signs HTTPS traffic with its own root certificate, and Firefox does not trust that root. It is not a problem with the website's certificate, and not a DNS or HTTP error.

The error is typically Firefox-only because Firefox keeps its own root store. Software that adds its root only to Windows or macOS works silently in Chrome, Edge and Safari but breaks Firefox. Mozilla reported in 2019 a significant increase in this kind of error after Firefox 65, often triggered by antivirus software scanning HTTPS.

Since Firefox 68, when a MITM error is detected Firefox automatically turns on the "enterprise roots" preference (security.enterprise_roots.enabled), imports roots that a user, an administrator or installed software added to the operating system, and retries. This import exists on Windows and macOS. If the error persists after that, the interception root is not in the OS store either, or you are on Linux, where the import is not available.

Chrome has a separate code, ERR_CERT_KNOWN_INTERCEPTION_BLOCKED, for certificates Chrome knows are used for interception by someone other than the device owner. That is a blocklist, not the same mechanism.

Your CDN, nginx or load balancer cannot cause this error: it is triggered by an untrusted issuer on the visitor's side, so Cloudflare SSL modes and origin certificates are irrelevant. The proxy that matters is the one between the visitor and the internet; compare the issuer seen from the affected machine with the one seen from a clean network:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer

An antivirus or company name as issuer on the affected machine, and a public CA from the clean network, means local interception.

1. Confirm your certificate is fine from outside. Run the openssl command above from a server or use an external checker. If it shows your public CA and a complete chain, there is nothing to change on the server.
2. Tell affected users what is happening. Reports of this code from many users usually mean a popular antivirus product or an ISP-level inspection is involved, not your configuration.
3. If you run the inspection proxy (IT admins): deploy its root to Firefox through enterprise policy instead of asking users to click through. In policies.json:

   {
     "policies": {
       "Certificates": {
         "ImportEnterpriseRoots": true,
         "Install": ["/etc/pki/inspection-root.pem"]
       }
     }
   }

   ImportEnterpriseRoots covers Windows and macOS; Install is the way to add a root on Linux.
4. Do not rely on click-through. Firefox offers no exception on HSTS hosts, so asking users to accept the risk fails exactly on the sites that matter; the root has to be trusted properly.

• Find the issuer. On the error page, open the certificate details and read the issuer name. An antivirus brand or your employer's name explains the error.
• Antivirus: turn off HTTPS or encrypted-connection scanning, or let the product reinstall its Firefox integration, then restart Firefox.
• Enable enterprise roots on Windows or macOS: in about:config set security.enterprise_roots.enabled to true. Only do this if you trust the software that installed the root.
• Removed the software but the error stays: delete security.pki.mitm_canary_issuer in about:config. Firefox also clears it after the next successful update check.
• Public Wi-Fi or an unknown issuer: disconnect and use mobile data or a trusted network. Do not accept the risk on sites where you log in.

Clearing the cache will not help: the certificate comes from the interceptor on every connection. The system clock is not the cause either.

After the change, restart Firefox and reload the page. The site information panel (the padlock) indicates when a site is verified by a certificate authority that is not in Mozilla's store, which confirms an imported root is in use. To see the certificate the site really serves, run the openssl issuer check from a clean network or test the host with the enterno.io SSL checker.

• SEC_ERROR_UNKNOWN_ISSUER: the underlying Firefox trust error
• NET::ERR_CERT_AUTHORITY_INVALID: the Chrome counterpart
• MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
• HSTS errors: why some sites cannot be bypassed
• TLS works in the browser but fails in a client