SEC_ERROR_UNKNOWN_ISSUER in Firefox: Fix Guide

• Self-signed certificate (not from a public CA)
• Server returns only the server cert without intermediate CA
• Issuer CA is not in the Mozilla CA Certificate Program
• Corporate/government CA requires manual install
• Certificate in pfx/pkcs12 without its chain

1. Check the chain with Enterno SSL Checker — you should see 3 levels: site → intermediate → root
2. For nginx: use fullchain.pem, not just cert.pem
3. For Apache: add SSLCertificateChainFile with the intermediate CA
4. If self-signed — issue Let's Encrypt: certbot --nginx -d example.com
5. For a corporate CA: install the root in every Firefox (Preferences → Privacy → Certificates)

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The SEC_ERROR_UNKNOWN_ISSUER error in Firefox indicates that the web browser cannot verify the SSL certificate of the website due to an unrecognized certificate authority (CA). To resolve this issue, ensure that the SSL certificate is issued by a trusted CA, check your system's certificate store, or manually add the certificate to Firefox's trusted certificates. For immediate resolution, verify the certificate chain and ensure that all intermediate certificates are correctly installed.

The SEC_ERROR_UNKNOWN_ISSUER error occurs when Firefox encounters an SSL certificate that it cannot validate against its list of trusted certificate authorities. This can happen for several reasons:

• The SSL certificate is self-signed and not recognized by Firefox.
• The certificate is issued by a CA that is not included in Firefox's trusted root certificate store.
• The certificate chain is incomplete, missing intermediate certificates necessary for validation.

To ensure SSL certificates are valid, they should be issued by recognized CAs such as DigiCert, Let's Encrypt, or GlobalSign. In practice, you can check the validity of a certificate using the openssl command-line tool.

openssl s_client -connect example.com:443 -showcerts

This command retrieves the SSL certificate from the specified domain and displays the certificate chain. Verify that all certificates in the chain are present and correctly linked.

To address the SEC_ERROR_UNKNOWN_ISSUER error, follow these steps:

1. Verify the Certificate Chain: Use the openssl command to check the SSL certificate chain.
2. Install Missing Intermediate Certificates: If the command output indicates missing intermediate certificates, obtain them from your SSL provider and install them on your server. For example, if you are using Apache, you would add the following lines to your configuration:

SSLCertificateFile /path/to/your_certificate.crt
SSLCertificateKeyFile /path/to/your_private.key
SSLCertificateChainFile /path/to/intermediate_certificate.crt

1. Check Firefox's Certificate Store: Open Firefox, type about:preferences#privacy in the address bar, scroll down to the Certificates section, and click on View Certificates. From there, check if the CA is listed under the Authorities tab.
2. Add the Certificate Manually: If the certificate is self-signed or from an untrusted CA, you can add it manually. In the View Certificates window, click on the Import button and select the certificate file. Ensure you check the box to trust the certificate for identifying websites.

After making these changes, restart Firefox and revisit the website. If the issue persists, consider checking server configurations or consulting with your SSL provider for further assistance.