SEC_ERROR_UNKNOWN_ISSUER in Firefox: Fix Guide
SEC_ERROR_UNKNOWN_ISSUER means Firefox does not trust the SSL certificate issuer. Firefox ships its own Mozilla trust store (≠ system store), so regional or corporate CAs often fail. Causes: self-signed cert, missing intermediate CA, CA not in Mozilla store. Fix: use Let's Encrypt or a commercial CA + the full fullchain bundle.
This error blocks HTTPS access. Below: causes, fixes, working config, FAQ.
Common Causes
- Self-signed certificate (not from a public CA)
- Server returns only the server cert without intermediate CA
- Issuer CA is not in the Mozilla CA Certificate Program
- Corporate/government CA requires manual install
- Certificate in pfx/pkcs12 without its chain
Step-by-Step Fix
- Check the chain with Enterno SSL Checker — you should see 3 levels: site → intermediate → root
- For nginx: use fullchain.pem, not just cert.pem
- For Apache: add
SSLCertificateChainFilewith the intermediate CA - If self-signed — issue Let's Encrypt:
certbot --nginx -d example.com - For a corporate CA: install the root in every Firefox (Preferences → Privacy → Certificates)
Example: Proper nginx TLS config
server {
listen 443 ssl http2;
server_name example.com;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;
ssl_stapling on;
ssl_stapling_verify on;
}Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
Why does Chrome work but Firefox does not?
Chrome and Firefox ship different trusted-CA lists. Chrome since 2023 ships its own chrome-root-store. If your CA is only in the Chrome store — Firefox shows SEC_ERROR_UNKNOWN_ISSUER.
How do I bypass the error temporarily?
Click "Advanced → Accept the Risk and Continue". Works only for ad-hoc visits. Not recommended for production sites.
What is the Mozilla CA Certificate Program?
The public list of CAs Firefox trusts. ~150 CAs. Getting in takes 1–2 years and requires a WebTrust audit.
Is Let's Encrypt in Firefox?
Yes. Cross-signed via ISRG Root X1, which is in the Mozilla store. Works in every modern Firefox.