> What SEC_ERROR_UNKNOWN_ISSUER means in Firefox, what visitors should do, and how IT and site owners fix private CAs, proxies and missing intermediates. Source: https://pkizerotohero.com/errors/firefox-sec-error-unknown-issuer/ · Last reviewed: 2026-10-20 - Firefox - Exact text checked with the real tool # SEC\_ERROR\_UNKNOWN\_ISSUER Also seen in: Thunderbird, other NSS-based applications **In one sentence:** Firefox could not link the site's certificate to a trusted root: an unknown private or proxy CA, a self-signed certificate, or a missing intermediate. [Check yours: Certificate decoder](https://pkizerotohero.com/tools/decoder/) ## Where you see it As a full-page warning in Firefox. Recent versions title the page “Warning: Security Risk” and show: ```text Be careful. Something doesn’t look right. Firefox spotted a potentially serious security issue with intranet.example.com. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails. ``` Under **Advanced**: ```text There’s an issue with the site’s certificate. It’s possible that a bad actor is trying to impersonate the site. Sites use certificates issued by a certificate authority to prove they’re really who they say they are. Firefox doesn’t trust this site because we can’t tell who issued the certificate, it’s self-signed, or the site isn’t sending intermediate certificates we trust. ... Error Code: SEC_ERROR_UNKNOWN_ISSUER ``` Older versions show the same code on a page titled “Warning: Potential Security Risk Ahead”, with: “Websites prove their identity via certificates. Firefox does not trust intranet.example.com because its certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates.” The texts are in Firefox’s [certificate error strings](https://searchfox.org/firefox-main/source/toolkit/locales/en-US/toolkit/neterror/certError.ftl). For a single self-signed certificate, Firefox uses a separate code, `MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT`. ## What it means Firefox needs a [certificate chain](https://pkizerotohero.com/handbook/glossary/#certificate-chain) from the site’s certificate to a [root certificate](https://pkizerotohero.com/handbook/glossary/#root-certificate) it trusts. It could not find the certificate of whoever issued one of the certificates, so it cannot tell whether the site is genuine. Firefox keeps its own list of trusted roots from Mozilla’s root program. On Windows, macOS and Android it also trusts, by default, roots that users or administrators added to the operating system; on Linux it usually keeps its own separate store. So a site can work in Chrome and fail in Firefox. Note If you are just visiting a website Do not accept the risk. On a public site, this usually means an intercepting network (some hotel and public Wi-Fi) or antivirus software that inspects HTTPS. Try another network. If it is a company site, contact your IT helpdesk. ## Likely causes ### A private CA that Firefox does not know Internal sites often use a company CA. Firefox on Windows and macOS normally trusts a root that IT added to the operating system, but not if that option has been turned off, and Firefox on Linux usually does not see it. Click **View the site’s certificate** on the warning page and look at the issuer. From a terminal: ```bash openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts /dev/null | grep -E '^ [0-9]+ s:|^ i:' ``` **Fix for IT:** make Firefox trust the roots from the operating system with the enterprise policy `ImportEnterpriseRoots`, or install the root with the `Certificates` → `Install` policy. Both are described in Mozilla’s [policy templates](https://mozilla.github.io/policy-templates/). For one machine on Windows or macOS, check that the option to trust third-party root certificates from the operating system is on under **Settings** → **Privacy & Security** → **Certificates** (the `security.enterprise_roots.enabled` preference; see [Mozilla support](https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox)), or import the root under **Settings** → **Privacy & Security** → **Certificates** → **View Certificates** → **Authorities**. ### Antivirus or a TLS-inspection proxy If many sites fail at once, a [TLS-inspection](https://pkizerotohero.com/handbook/glossary/#tls-inspection) proxy or an antivirus product that scans HTTPS is re-signing traffic with its own root. Firefox’s own text mentions this. Check the issuer on a public site; if it names a security product, either let IT deploy that root to Firefox as above, or switch off HTTPS scanning in the antivirus product. ### The server leaves out an intermediate Unlike Chrome and Edge, Firefox does not download missing intermediates. For public CAs, desktop Firefox ships a [preloaded list of known intermediates](https://wiki.mozilla.org/Security/CryptoEngineering/Intermediate_Preloading), so the mistake often stays hidden; for private CAs it does not, and the site fails. Count what the server sends: ```bash openssl s_client -connect intranet.example.com:443 -servername intranet.example.com -showcerts /dev/null | grep -c 'BEGIN CERTIFICATE' ``` **Fix for site owners:** serve the certificate followed by its [intermediate certificate](https://pkizerotohero.com/handbook/glossary/#intermediate-certificate) (`fullchain.pem` in nginx, `SSLCertificateFile` with the chain in Apache, the intermediate store on IIS). See [verify error:num=21](https://pkizerotohero.com/errors/openssl-verify-error-21/). ### A self-signed certificate Development servers and device admin pages often use a [self-signed certificate](https://pkizerotohero.com/handbook/glossary/#self-signed-certificate) (`MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT`). Replace it with a certificate from your company CA or, for public sites, from a public CA such as Let’s Encrypt. Warning Proceeding is not a fix “Proceed to … (Risky)” (in older versions “Accept the Risk and Continue”) adds an exception for that certificate. If the warning was caused by an attacker, you have just trusted the attacker. Install the right root or fix the server instead. ## Check yours *Interactive tool: Certificate decoder (runs in the browser at [/tools/decoder/](https://pkizerotohero.com/tools/decoder/))* Paste the site’s certificate (from **View the site’s certificate** → download PEM, or from `openssl s_client -showcerts`). The decoder shows the issuer and whether the certificate is self-signed. ## Learn why - [Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/): why Firefox has its own root store. - [Certificate chains and path validation](https://pkizerotohero.com/handbook/certificate-chains/): AIA fetching versus preloaded intermediates. - Chrome’s version of this error: [NET::ERR\_CERT\_AUTHORITY\_INVALID](https://pkizerotohero.com/errors/chrome-err-cert-authority-invalid/). - See also: [MOZILLA\_PKIX\_ERROR\_SELF\_SIGNED\_CERT](https://pkizerotohero.com/errors/firefox-mozilla-pkix-self-signed-cert/), when the site’s certificate is self-signed. **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/errors/firefox-sec-error-unknown-issuer/). Last reviewed 20 October 2026Edition 0.9 ## Learn why it happens - [Chapter 12: Who do we trust? CAs, trust stores and self-signed certificates](https://pkizerotohero.com/handbook/trust-stores/) - [Chapter 13: Certificate chains and path validation](https://pkizerotohero.com/handbook/certificate-chains/) ## Fix it step by step - [How to trust a private root CA on Windows](https://pkizerotohero.com/guides/add-root-ca-windows/) - [How to trust a private root CA on macOS](https://pkizerotohero.com/guides/add-root-ca-macos/) ## Everything on this topic - [Chains and trust stores](https://pkizerotohero.com/topics/chains-and-trust/)