SEC_ERROR_UNKNOWN_ISSUER Browser Origin: On your device Last updated 15 Oct 2026

Firefox: Warning: Potential Security Risk Ahead — SEC_ERROR_UNKNOWN_ISSUER (certificate not trusted)

Firefox does not trust the authority that issued the site's certificate — a self-signed certificate, a missing intermediate, or a corporate TLS-inspecting proxy.

Exact message you may see Warning: Potential Security Risk AheadFirefox does not trust this site because the certificate
Explore the map of this error Full error map →
Seen on: Firefox Nginx Linux

Meaning

Firefox ships its own certificate store, so it can fail where Chrome works (e.g. an intermediate certificate missing from the server chain, or a company CA installed only in the OS store). Owners should serve the full chain; users on corporate networks may need the company root CA imported.

Common causes

  • Self-signed or private-CA certificate
  • Server sends only the leaf certificate, not the intermediate chain
  • Antivirus or corporate proxy intercepting TLS with its own CA
  • Wrong system date making the chain invalid
  • Outdated Firefox/OS root store

⚡ Quick fix

  1. Owners: install the full chain (fullchain.pem) on the server
  2. Test with an SSL checker for chain issues
  3. Corporate users: import the company root CA or enable security.enterprise_roots.enabled

Detailed fix by platform

Nginx

  1. ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; — use fullchain, not cert.pem
  2. Reload with nginx -t && systemctl reload nginx

Firefox

  1. about:config → security.enterprise_roots.enabled = true to trust the OS certificate store (managed devices)

Linux

  1. openssl s_client -connect example.com:443 -servername example.com -showcerts shows the chain the server sends

How to diagnose

  1. Chain — Does the server send intermediates?
  2. Network — Same error on home network?
  3. Clock — Correct date?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

Challenge failed for domain — Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404 (SSL / TLS)Challenge failed for …ERR_CERT_AUTHORITY_INVALID — NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private) (JavaScript)ERR_CERT_AUTHORITY_IN…ERR_SSL_VERSION_OR_CIPHER_MISMATCH — Chrome: This site can’t provide a secure connection — uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Browser)ERR_SSL_VERSION_OR_CI…NET::ERR_CERT_COMMON_NAME_INVALID — NET::ERR_CERT_COMMON_NAME_INVALID: Your connection is not private (certificate is for a different domain) (SSL / TLS)NET::ERR_CERT_COMMON_…NET::ERR_CERT_REVOKED — Chrome: Your connection is not private — NET::ERR_CERT_REVOKED (the certificate was revoked) (Browser)NET::ERR_CERT_REVOKEDno start line — OpenSSL: unable to load certificate / PEM routines:get_name:no start line (key values mismatch) (SSL / TLS)no start lineServer not found — Firefox: Hmm. We’re having trouble finding that site. / Server not found (DNS_PROBE or NS_ERROR_UNKNOWN_HOST) (Browser)Server not foundSSL_ERROR_NO_CYPHER_OVERLAP — Firefox: Secure Connection Failed — SSL_ERROR_NO_CYPHER_OVERLAP (no common cipher) (Browser)SSL_ERROR_NO_CYPHER_O…SEC_ERROR…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.