MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT in Firefox: How to Fix It

A self-signed certificate names itself as issuer and is signed with its own private key. Firefox first tries to build a chain to a trusted root; when no issuer exists and the certificate verifies as self-signed, it reports MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT with the line "The certificate is not trusted because it is self-signed." A certificate signed by a private CA that you have not imported gives SEC_ERROR_UNKNOWN_ISSUER instead.

The connection is still encrypted, but nothing proves you reached the real server. Chromium's source puts it precisely: a self-signed certificate provides "no defense against active attackers (but foiling passive attackers)". This is a trust problem at the TLS layer, not DNS, not HTTP. The Chrome and Edge counterpart is NET::ERR_CERT_AUTHORITY_INVALID.

Where self-signed certificates come from: admin interfaces of routers, NAS boxes, printers and hypervisors; the Debian and Ubuntu placeholder pair /etc/ssl/certs/ssl-cert-snakeoil.pem used by Apache's default-ssl site; a certificate made with openssl req -x509 on a staging server that ended up in production; and a TLS terminator falling back to its built-in certificate after a failed upload.

Recent Chromium source also defines ERR_CERT_SELF_SIGNED_LOCAL_NETWORK for self-signed certificates on .local names and private (RFC 1918) IP addresses. On public hostnames Chrome reports ERR_CERT_AUTHORITY_INVALID.

A self-signed certificate on the origin is invisible to visitors while a CDN terminates TLS. Cloudflare's Full mode accepts it without validation; Full (strict) rejects it with error 526. The clean fix is a Cloudflare Origin CA certificate or a public certificate on the origin. Visitors see the self-signed certificate only when the record is DNS only or Cloudflare is paused.

The same applies to your own reverse proxy. nginx does not verify an HTTPS upstream unless told to, so a self-signed backend works but is unauthenticated. Verify it against your internal CA instead of switching checks off:

location / {
    proxy_pass https://10.0.0.5:8443;
    proxy_ssl_verify              on;
    proxy_ssl_trusted_certificate /etc/nginx/internal-ca.pem;
    proxy_ssl_server_name         on;
    proxy_ssl_name                app.internal;
}

1. Confirm the diagnosis:

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
     | openssl x509 -noout -subject -issuer
   # identical subject and issuer = self-signed; s_client also prints num=18:self-signed certificate

2. Public site: replace it with a publicly trusted certificate, e.g. sudo certbot --nginx -d example.com -d www.example.com, or point Apache's SSLCertificateFile and SSLCertificateKeyFile away from the snakeoil pair. Guide: free Let's Encrypt setup.
3. Intranet and devices: run an internal CA, issue leaf certificates with SAN entries from it, and deploy the CA root to all clients through device management or Firefox enterprise policy.
4. Local development: use a local CA instead of one-off self-signed certificates:

   mkcert -install                       # creates a local CA and trusts it
   mkcert example.test localhost 127.0.0.1 ::1
   # → ./example.test+3.pem and ./example.test+3-key.pem

   On Linux, Firefox trust needs certutil (NSS tools) installed before mkcert -install. Never share the generated rootCA-key.pem.
5. Do not import the server certificate itself under Authorities. If it carries CA:TRUE, which openssl req -x509 adds by default in OpenSSL 3, Firefox then fails with MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY.

• A public site (shop, bank, webmail) with a self-signed certificate: do not continue. It is either broken or someone is intercepting the connection; contact the owner another way.
• Your own device (router at 192.168.1.1, NAS): accepting the risk is reasonable once you compare the SHA-256 fingerprint in View Certificate with the one shown in the device's console or manual. Firefox remembers the exception; remove it under Settings > Privacy & Security > Certificates > View Certificates > Servers.
• A work intranet: ask IT whether the certificate is expected, and whether they can deploy their CA instead.

On HSTS sites Firefox shows no exception button at all (HSTS errors). Clearing the cache does nothing, because certificates are not stored in the HTTP cache.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep "Verify return code"
# → Verify return code: 0 (ok)

curl -sS -o /dev/null https://example.com/ && echo OK
# still self-signed: curl: (60) SSL certificate problem: self-signed certificate

For an outside view of the issuer and chain your server presents, run the enterno.io SSL checker.

• NET::ERR_CERT_AUTHORITY_INVALID (Chrome counterpart)
• MOZILLA_PKIX_ERROR_MITM_DETECTED
• SSL_ERROR_BAD_CERT_DOMAIN
• Self-signed certificates explained