MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

Where you see it

As a full-page warning in Firefox, titled “Warning: Security Risk” in recent versions. Under Advanced:

What makes the site look dangerous?
Because there’s an issue with the site’s certificate. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. This site’s certificate is self-signed. It wasn’t issued by a recognized certificate authority – so we don’t trust it by default.
What can you do about it?
Not much. It’s likely there’s a problem with the site itself.
IMPORTANT NOTE: If you are trying to visit this site on a corporate intranet, your IT staff may use self-signed certificates. They can help you check their authenticity.
...
Error Code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

The texts are in Firefox’s certificate error strings. Firefox uses this code instead of SEC_ERROR_UNKNOWN_ISSUER when the site’s certificate is signed by its own key. Chrome and Edge show the same situation as NET::ERR_CERT_AUTHORITY_INVALID.

What it means

A self-signed certificate names itself as its own issuer and is signed with its own key, so there is no CA vouching for it. Anyone can make one for any name in a second. Firefox trusts a certificate only if it leads to a root certificate that is already in its trust store; being self-signed does not make a certificate trusted. This one is not in the store, so Firefox cannot tell the real site from an impostor.

Likely causes

A device or test server came with a self-signed certificate

Routers, printers, NAS boxes, server management boards, firewalls and many self-hosted applications create a self-signed certificate on first start. Test servers often use one too. Confirm: subject and issuer are the same.

openssl s_client -connect nas.example.internal:443 -servername nas.example.internal </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

subject=CN=nas.example.internal
issuer=CN=nas.example.internal

Fix: give the server a certificate from a CA your browsers trust. Inside a company, that is the company’s private CA; for public names, a public CA such as Let’s Encrypt. Most devices let you upload a certificate and key. For a lab, build a small CA once and trust its root: How to build a test CA with OpenSSL or How to run a small private CA with step-ca, then trust the root on Windows, macOS or Linux.

On Windows and macOS, Firefox trusts roots that you or IT add to the operating system by default (Settings → Privacy & Security → Certificates). You can also import the root in Firefox under View Certificates → Authorities.

Import the CA’s root, not the server’s self-signed certificate. A self-signed certificate made with openssl req -x509 is often marked as a CA. If you import such a certificate as an authority, Firefox can then reject it with MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY, because a CA certificate may not be used as a server’s own certificate.

The server sends its default certificate

Web servers fall back to a default certificate when no site configuration matches the requested name. On Debian and Ubuntu, Apache’s default TLS site uses a self-signed “snakeoil” certificate. If the subject shows the machine’s own host name instead of your site’s name, this is the cause.

Fix: check that the site’s configuration has the right server_name (nginx) or ServerName (Apache) and listens on 443 with TLS, then reload. See How to install a certificate in nginx or in Apache httpd.

Something on the network replaced the certificate

If a public site that normally works shows a self-signed certificate, a captive portal, a misconfigured proxy or an attacker may be answering instead. Check the issuer from another network. Do not continue on the affected network.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the site’s certificate (from View the site’s certificate → PEM download, or from openssl s_client -showcerts). The decoder shows whether subject and issuer match, and whether it is marked as a CA.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates: why self-signed is not the same as trusted.
• A CA of your own: private two-tier PKI: the lasting fix for internal sites.
• Related: SEC_ERROR_UNKNOWN_ISSUER.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development