# Firefox: Warning: Potential Security Risk Ahead — SEC_ERROR_UNKNOWN_ISSUER (certificate not trusted)

**Code:** `SEC_ERROR_UNKNOWN_ISSUER` · **Category:** Browser · **Seen on:** Firefox, Nginx, Linux

Firefox does not trust the authority that issued the site's certificate — a self-signed certificate, a missing intermediate, or a corporate TLS-inspecting proxy.

## Meaning

Firefox ships its own certificate store, so it can fail where Chrome works (e.g. an intermediate certificate missing from the server chain, or a company CA installed only in the OS store). Owners should serve the full chain; users on corporate networks may need the company root CA imported.

## Common causes

- Self-signed or private-CA certificate
- Server sends only the leaf certificate, not the intermediate chain
- Antivirus or corporate proxy intercepting TLS with its own CA
- Wrong system date making the chain invalid
- Outdated Firefox/OS root store

## Quick fix

1. Owners: install the full chain (`fullchain.pem`) on the server
2. Test with an SSL checker for chain issues
3. Corporate users: import the company root CA or enable `security.enterprise_roots.enabled`

## Detailed fix by platform

### Nginx

1. `ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;` — use fullchain, not cert.pem
2. Reload with `nginx -t && systemctl reload nginx`

### Firefox

1. `about:config` → `security.enterprise_roots.enabled` = true to trust the OS certificate store (managed devices)

### Linux

1. `openssl s_client -connect example.com:443 -servername example.com -showcerts` shows the chain the server sends

## How to diagnose

1. **Chain** — Does the server send intermediates?
2. **Network** — Same error on home network?
3. **Clock** — Correct date?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/browser/firefox-sec-error-unknown-issuer)