SEC_ERROR_CA_CERT_INVALID

• Intermediate CA expired (Let's Encrypt X3 → X1 migration issues)
• Root CA removed from NSS store (Symantec, TurkTrust)
• Cert chain malformed — not DER/PEM standard
• Self-signed root not imported into Firefox trust
• Private CA with wrong CA:TRUE BasicConstraints

1. Reissue the cert — modern intermediate chained automatically
2. For Let's Encrypt: apache2ctl graceful + manual renew
3. Chain validator: Enterno SSL / SSLLabs
4. nginx: ssl_certificate fullchain.pem; (fullchain, not cert alone)
5. Private CA: BasicConstraints=CA:TRUE + valid pathLenConstraint

Check SSL Certificate →

• ERR_SSL_PROTOCOL_ERROR
• NET::ERR_CERT_AUTHORITY_INVALID
• SSL Handshake Failed
• All SSL errors

The SEC_ERROR_CA_CERT_INVALID error in Firefox indicates that the browser cannot verify the certificate authority (CA) for the website you are trying to access. To resolve this issue, check the website's SSL certificate, ensure your system time and date are correct, and potentially clear your browser cache or update Firefox. If the issue persists, consider updating the certificate authority list or checking for any expired certificates.

The SEC_ERROR_CA_CERT_INVALID error occurs when Firefox detects that the SSL certificate presented by a website is either self-signed, expired, or issued by an untrusted certificate authority. This error can prevent users from accessing secure websites, impacting both user experience and site credibility.

When encountering this error, it is essential to consider the following factors:

• Certificate Authority Trust: Ensure that the SSL certificate is issued by a recognized and trusted CA. Certificates from untrusted sources will trigger this error.
• Validity Period: Check if the SSL certificate has expired. Certificates typically have a validity period ranging from one to three years.
• Intermediary Certificates: Some SSL certificates require intermediary certificates to establish a complete trust chain. Ensure these are correctly installed on the server.

To diagnose the issue, users can check the certificate details by clicking on the padlock icon in the address bar, then selecting 'More Information' and 'View Certificate'. This will display the issuer, validity dates, and trust level of the certificate.

To effectively resolve the SEC_ERROR_CA_CERT_INVALID error, follow these practical steps:

1. Check System Time and Date: An incorrect system time can cause SSL certificate validation issues. Ensure your system clock is accurate.

date

On Linux, use the date command to verify the current date and time.

1. Clear Browser Cache: Cached data may interfere with SSL certificate validation. To clear the cache in Firefox:

• Go to Options > Privacy & Security.
• Under Cookies and Site Data, click Clear Data.

1. Update Firefox: Ensure you are using the latest version of Firefox, as updates may include fixes for certificate validation issues. To update:

• Click on the menu button and select Help, then About Firefox.
• Firefox will automatically check for updates and download them.

1. Manually Install Certificate: If the website uses a self-signed certificate or a CA not recognized by Firefox, you may need to manually add the certificate:

• Download the certificate file (usually a .crt or .cer file).
• Open Firefox and navigate to Options > Privacy & Security.
• Scroll down to the Certificates section and click on View Certificates.
• Under the Authorities tab, click Import and select the downloaded certificate file.

After following these steps, restart Firefox and try accessing the website again. If the issue persists, consider checking the server-side configuration or contacting the website administrator for further assistance.