SEC_ERROR_UNKNOWN_ISSUER in Firefox: How to Fix It

Firefox builds a path from the server certificate to a trusted root, using the certificates sent in the handshake and a preloaded set of intermediates from public CAs. Trusted roots are the Mozilla root store, roots you imported into Firefox and, on Windows, macOS and Android, third-party roots added to the operating system. If no issuer can be found, Firefox stops with SEC_ERROR_UNKNOWN_ISSUER and says it does not trust the site "because its certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates."

Firefox narrows this down where it can: a server certificate that signed itself becomes MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT, and an unknown issuer that matches its interception probe becomes MOZILLA_PKIX_ERROR_MITM_DETECTED. It is a trust failure at the TLS layer, not a DNS or protocol error. The Chrome and Edge counterpart is NET::ERR_CERT_AUTHORITY_INVALID.

Why Firefox and Chrome disagree. Chrome downloads a missing intermediate from the AIA URL in the certificate; Firefox does not. Firefox instead ships intermediates that public CAs disclose to Mozilla, so a missing chain from a mainstream CA usually still works, while an intermediate outside that set (a new one, or one from a private or regional CA) fails only in Firefox.

Interception. Antivirus HTTPS scanning and corporate TLS inspection re-sign sites with their own root. Current Firefox imports such roots from the OS store on Windows, macOS and Android (the security.enterprise_roots.enabled preference, on by default). On Linux it does not, so the root must be imported into Firefox itself or pushed by enterprise policy. When Firefox recognizes the interception it shows "Software is Preventing Firefox From Safely Connecting to This Site" instead.

Private CA. Intranet sites, appliances and some government or regional CAs are not in the Mozilla root store; every client needs the root installed.

• Cloudflare Origin CA. These certificates are trusted only by Cloudflare. If the proxy is paused or a record is DNS only, Firefox talks to the origin directly and shows SEC_ERROR_UNKNOWN_ISSUER. Re-enable the proxy or use a public certificate on the origin.
• Full (strict) mode. An origin with an untrusted issuer produces Cloudflare error 526 for visitors, not a browser certificate warning.
• Your own TLS terminator. nginx, HAProxy and Apache must send the leaf plus all intermediates.

# nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;   # not cert.pem
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

# Apache 2.4.8+: the chain goes in SSLCertificateFile
SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

1. Count the certificates the server sends:

   openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

   Only one certificate, plus verify error:num=20:unable to get local issuer certificate and num=21:unable to verify the first certificate, means the intermediate is missing. Details: incomplete certificate chain.
2. Serve fullchain.pem (or leaf followed by the CA bundle), then sudo nginx -t && sudo systemctl reload nginx.
3. On a public site, replace private-CA or self-signed certificates: sudo certbot --nginx -d example.com -d www.example.com.
4. On an intranet, distribute the root to Firefox with an enterprise policy, for example /etc/firefox/policies/policies.json on Linux:

   {
     "policies": {
       "Certificates": {
         "ImportEnterpriseRoots": true,
         "Install": ["/etc/pki/corp/root-ca.pem"]
       }
     }
   }

5. Test with a client that never fetches intermediates, such as curl, before declaring the chain fixed.

• Click Advanced, then View Certificate, and read the issuer. An antivirus or company name means interception: turn off HTTPS or encrypted-connection scanning in that product, or ask IT to deploy its root to Firefox.
• Try mobile data or another network. Some filtering proxies and Wi-Fi portals re-sign HTTPS.
• Import a root yourself only when you know who owns it, such as your employer: Settings > Privacy & Security > Certificates > View Certificates > Authorities > Import, and tick "Trust this CA to identify websites".
• If one public site fails everywhere and other sites work, the site is misconfigured; tell the owner.

"Accept the Risk and Continue" is not offered on HSTS sites. Clearing the cache does not help, because certificates are not stored in the HTTP cache.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | grep "Verify return code"
# → Verify return code: 0 (ok)

curl -sS -o /dev/null https://example.com/ && echo "chain OK"
# missing intermediate: curl: (60) SSL certificate problem: unable to get local issuer certificate

Reload the site in Firefox afterwards. To see the chain as the outside world gets it, use the enterno.io SSL checker.

• NET::ERR_CERT_AUTHORITY_INVALID (Chrome counterpart)
• MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
• MOZILLA_PKIX_ERROR_MITM_DETECTED
• SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE
• SEC_ERROR_CA_CERT_INVALID
• SSL_ERROR_BAD_CERT_DOMAIN