SEC_ERROR_UNKNOWN_ISSUER

Where you see it

As a full-page warning in Firefox. Recent versions title the page “Warning: Security Risk” and show:

Be careful. Something doesn’t look right.
Firefox spotted a potentially serious security issue with intranet.example.com. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails.

Under Advanced:

There’s an issue with the site’s certificate. It’s possible that a bad actor is trying to impersonate the site. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because we can’t tell who issued the certificate, it’s self-signed, or the site isn’t sending intermediate certificates we trust.
...
Error Code: SEC_ERROR_UNKNOWN_ISSUER

Older versions show the same code on a page titled “Warning: Potential Security Risk Ahead”, with: “Websites prove their identity via certificates. Firefox does not trust intranet.example.com because its certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates.” The texts are in Firefox’s certificate error strings. For a single self-signed certificate, Firefox uses a separate code, MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT.

What it means

Firefox needs a certificate chain from the site’s certificate to a root certificate it trusts. It could not find the certificate of whoever issued one of the certificates, so it cannot tell whether the site is genuine. Firefox keeps its own list of trusted roots from Mozilla’s root program. On Windows, macOS and Android it also trusts, by default, roots that users or administrators added to the operating system; on Linux it usually keeps its own separate store. So a site can work in Chrome and fail in Firefox.

Likely causes

A private CA that Firefox does not know

Internal sites often use a company CA. Firefox on Windows and macOS normally trusts a root that IT added to the operating system, but not if that option has been turned off, and Firefox on Linux usually does not see it. Click View the site’s certificate on the warning page and look at the issuer. From a terminal:

openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts </dev/null 2>/dev/null | grep -E '^ [0-9]+ s:|^   i:'

Fix for IT: make Firefox trust the roots from the operating system with the enterprise policy ImportEnterpriseRoots, or install the root with the Certificates → Install policy. Both are described in Mozilla’s policy templates. For one machine on Windows or macOS, check that the option to trust third-party root certificates from the operating system is on under Settings → Privacy & Security → Certificates (the security.enterprise_roots.enabled preference; see Mozilla support), or import the root under Settings → Privacy & Security → Certificates → View Certificates → Authorities.

Antivirus or a TLS-inspection proxy

If many sites fail at once, a TLS-inspection proxy or an antivirus product that scans HTTPS is re-signing traffic with its own root. Firefox’s own text mentions this. Check the issuer on a public site; if it names a security product, either let IT deploy that root to Firefox as above, or switch off HTTPS scanning in the antivirus product.

The server leaves out an intermediate

Unlike Chrome and Edge, Firefox does not download missing intermediates. For public CAs, desktop Firefox ships a preloaded list of known intermediates, so the mistake often stays hidden; for private CAs it does not, and the site fails. Count what the server sends:

openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts </dev/null 2>/dev/null | grep -c 'BEGIN CERTIFICATE'

Fix for site owners: serve the certificate followed by its intermediate certificate (fullchain.pem in nginx, SSLCertificateFile with the chain in Apache, the intermediate store on IIS). See verify error:num=21.

A self-signed certificate

Development servers and device admin pages often use a self-signed certificate (MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT). Replace it with a certificate from your company CA or, for public sites, from a public CA such as Let’s Encrypt.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the site’s certificate (from View the site’s certificate → download PEM, or from openssl s_client -showcerts). The decoder shows the issuer and whether the certificate is self-signed.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates: why Firefox has its own root store.
• Certificate chains and path validation: AIA fetching versus preloaded intermediates.
• Chrome’s version of this error: NET::ERR_CERT_AUTHORITY_INVALID.
• See also: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT, when the site’s certificate is self-signed.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development