> Fix MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT in Firefox: find out why the site uses a self-signed certificate, then replace it with one from a CA you trust. Source: https://pkizerotohero.com/errors/firefox-mozilla-pkix-self-signed-cert/ · Last reviewed: 2026-10-20 - Firefox - Exact text checked with the real tool # MOZILLA\_PKIX\_ERROR\_SELF\_SIGNED\_CERT Also seen in: Thunderbird **In one sentence:** The site presents a self-signed certificate that Firefox does not trust: typical for device admin pages, test servers and default certificates. Replace it with one from a trusted CA. [Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/) ## Where you see it As a full-page warning in Firefox, titled “Warning: Security Risk” in recent versions. Under **Advanced**: ```text What makes the site look dangerous? Because there’s an issue with the site’s certificate. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. This site’s certificate is self-signed. It wasn’t issued by a recognized certificate authority – so we don’t trust it by default. What can you do about it? Not much. It’s likely there’s a problem with the site itself. IMPORTANT NOTE: If you are trying to visit this site on a corporate intranet, your IT staff may use self-signed certificates. They can help you check their authenticity. ... Error Code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT ``` The texts are in Firefox’s [certificate error strings](https://searchfox.org/firefox-main/source/toolkit/locales/en-US/toolkit/neterror/certError.ftl). Firefox uses this code instead of `SEC_ERROR_UNKNOWN_ISSUER` when the site’s certificate is signed by its own key. Chrome and Edge show the same situation as [NET::ERR\_CERT\_AUTHORITY\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-authority-invalid/). ## What it means A [self-signed certificate](https://pkizerotohero.com/handbook/glossary/#self-signed-certificate) names itself as its own issuer and is signed with its own key, so there is no CA vouching for it. Anyone can make one for any name in a second. Firefox trusts a certificate only if it leads to a [root certificate](https://pkizerotohero.com/handbook/glossary/#root-certificate) that is already in its [trust store](https://pkizerotohero.com/handbook/glossary/#trust-store); being self-signed does not make a certificate trusted. This one is not in the store, so Firefox cannot tell the real site from an impostor. Note If you are just visiting a website On a public website, do not continue: a real public site does not use a self-signed certificate, so this can mean an intercepting network. On a device you own or a company system, ask the owner or IT how the certificate should look, as Firefox suggests. ## Likely causes ### A device or test server came with a self-signed certificate Routers, printers, NAS boxes, server management boards, firewalls and many self-hosted applications create a self-signed certificate on first start. Test servers often use one too. **Confirm:** subject and issuer are the same. ```bash openssl s_client -connect nas.example.internal:443 -servername nas.example.internal /dev/null | openssl x509 -noout -subject -issuer ``` ```text subject=CN=nas.example.internal issuer=CN=nas.example.internal ``` **Fix:** give the server a certificate from a CA your browsers trust. Inside a company, that is the company’s private CA; for public names, a public CA such as Let’s Encrypt. Most devices let you upload a certificate and key. For a lab, build a small CA once and trust its root: [How to build a test CA with OpenSSL](https://pkizerotohero.com/guides/openssl-test-ca/) or [How to run a small private CA with step-ca](https://pkizerotohero.com/guides/private-ca-step-ca/), then [trust the root on Windows](https://pkizerotohero.com/guides/add-root-ca-windows/), [macOS](https://pkizerotohero.com/guides/add-root-ca-macos/) or [Linux](https://pkizerotohero.com/guides/add-root-ca-linux/). On Windows and macOS, Firefox trusts roots that you or IT add to the operating system by default (Settings → Privacy & Security → Certificates). You can also import the root in Firefox under **View Certificates** → **Authorities**. Import the CA’s root, not the server’s self-signed certificate. A self-signed certificate made with `openssl req -x509` is often marked as a CA. If you import such a certificate as an authority, Firefox can then reject it with `MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY`, because a CA certificate may not be used as a server’s own certificate. ### The server sends its default certificate Web servers fall back to a default certificate when no site configuration matches the requested name. On Debian and Ubuntu, Apache’s default TLS site uses a self-signed “snakeoil” certificate. If the subject shows the machine’s own host name instead of your site’s name, this is the cause. **Fix:** check that the site’s configuration has the right `server_name` (nginx) or `ServerName` (Apache) and listens on 443 with TLS, then reload. See [How to install a certificate in nginx](https://pkizerotohero.com/guides/install-certificate-nginx/) or [in Apache httpd](https://pkizerotohero.com/guides/install-certificate-apache/). ### Something on the network replaced the certificate If a public site that normally works shows a self-signed certificate, a captive portal, a misconfigured proxy or an attacker may be answering instead. Check the issuer from another network. Do not continue on the affected network. Warning Proceeding is not a fix “Proceed to … (Risky)” stores an exception for this exact certificate. On a public site you would be trusting whoever answered. For a device you own that truly cannot get another certificate, compare the SHA-256 fingerprint Firefox shows (**View the site’s certificate**) with the one on the device’s own console before you accept, and treat any later change as an alarm. Replacing the certificate is still the real fix. ## Check yours *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* Paste the site’s certificate (from **View the site’s certificate** → PEM download, or from `openssl s_client -showcerts`). The decoder shows whether subject and issuer match, and whether it is marked as a CA. ## Learn why - [Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/): why self-signed is not the same as trusted. - [A CA of your own: private two-tier PKI](https://pkizerotohero.com/handbook/private-ca/): the lasting fix for internal sites. - Related: [SEC\_ERROR\_UNKNOWN\_ISSUER](https://pkizerotohero.com/errors/firefox-sec-error-unknown-issuer/). **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/firefox-mozilla-pkix-self-signed-cert/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 12: Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/) - [Chapter 8: Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/) ## Everything on this topic - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/)