MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

• Self-signed = subject == issuer (same CN). openssl x509 -noout -issuer -subject will show
• Production: Let's Encrypt via certbot — automated 90-day cert + auto-renew. Free
• Dev: mkcert — installs a local root CA + generates certs trusted on the machine
• Exception in Firefox: "Advanced → Accept the Risk and Continue" (only if you trust the host)
• Internal infrastructure (corp): use an internal CA + GPO/MDM distribution of the root cert

# 1. Production fix — Let's Encrypt (Ubuntu, nginx)
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
# Auto-renew is already in /etc/cron.d/certbot

# 2. Dev fix — mkcert (macOS / Linux / Windows)
brew install mkcert  # or choco install mkcert
mkcert -install      # installs the local CA in the system trust store
mkcert example.local localhost 127.0.0.1
# Outputs: example.local+2.pem (cert) + example.local+2-key.pem
# nginx: ssl_certificate /path/example.local+2.pem; ssl_certificate_key ...

# 3. Detect cert type
openssl x509 -in cert.pem -noout -issuer -subject
# If issuer == subject — self-signed

• SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE
• API uptime monitoring

To resolve the MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT error in Firefox, you need to ensure that your website's SSL certificate is trusted. This can be achieved by either obtaining a valid SSL certificate from a trusted Certificate Authority (CA) or manually adding the self-signed certificate to Firefox's certificate store. For detailed steps, see the sections below.

The MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT error occurs when Firefox encounters a self-signed SSL certificate that it cannot verify against a trusted Certificate Authority (CA). This indicates that the certificate is not trusted by default, which is a common scenario in development environments or when using self-signed certificates for testing purposes.

When a browser connects to a website, it checks the SSL certificate presented by the server. If the certificate is self-signed, the browser will not find a chain of trust leading to a recognized CA, triggering the MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT error. This is a security measure to prevent man-in-the-middle attacks and ensure secure communications.

To resolve this issue, there are two primary approaches:

• Obtain a Valid SSL Certificate: The most straightforward solution is to acquire an SSL certificate from a trusted CA, such as Let's Encrypt, DigiCert, or Comodo. This will ensure that your certificate is recognized by all major browsers.
• Add the Self-Signed Certificate to Firefox: If you must use a self-signed certificate (e.g., for development purposes), you can add it to Firefox's trusted certificates manually. This allows Firefox to accept the self-signed certificate without throwing an error.

If you decide to use a self-signed certificate, you can add it to Firefox's certificate store to eliminate the MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT error. Follow these steps:

1. Export the Self-Signed Certificate: If you have access to the server, you can export the self-signed certificate. The command below can be used to export the certificate in PEM format:

openssl x509 -in your_certificate.crt -out your_certificate.pem -outform PEM

1. Open Firefox Settings: Launch Firefox and navigate to the menu by clicking the three horizontal lines in the upper right corner. Select Settings.
2. Access Certificates: In the Settings tab, search for Certificates in the search bar or scroll down to Privacy & Security. Click on View Certificates.
3. Import the Certificate: In the Certificate Manager window, go to the Authorities tab and click Import. Select the PEM file you exported earlier and click Open.
4. Trust the Certificate: A dialog box will appear asking how you want to trust this certificate. Check the box for Trust this CA to identify websites and click OK.
5. Restart Firefox: Close the Certificate Manager and restart Firefox to apply the changes.

After completing these steps, navigate back to the website that previously gave you the error. The MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT should no longer appear, allowing you to establish a secure connection without issues.