SEC_ERROR_UNKNOWN_ISSUER

Shown on the warning page under "Advanced" as "Error code: SEC_ERROR_UNKNOWN_ISSUER"; automation tools report the bare code. Self-signed site certificates get their own code (MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT) on the warning page; the Playwright build reported them only as SSL_ERROR_UNKNOWN in our test.

Firefox (NSS) — "Warning: Potential Security Risk Ahead", certificate issuer not trusted

What it means

Firefox could not build a chain from the site's certificate to a root in its trust store, so it shows "Warning: Potential Security Risk Ahead" with error code SEC_ERROR_UNKNOWN_ISSUER. Firefox uses its own NSS root store (Mozilla's list), not the operating system's, unless enterprise roots are enabled. A private CA, an inspecting proxy, or a server that omits its intermediate are the usual causes.

Why it happens

• A private CA or TLS-inspecting proxy

  common

  Company roots installed in Windows or macOS are not used by Firefox unless security.enterprise_roots.enabled (or the ImportEnterpriseRoots policy) is on.

• The server omits its intermediate

  common

  Firefox preloads the intermediates of public CAs, which hides many such misconfigurations; private intermediates and new ones still fail.

• The root was installed in the OS but not in Firefox

  occasional

  On Linux especially, roots in the system bundle are not part of Firefox's store.

How to fix it

1. 1.

   Managed devices: trust the company root via policy

   policies.json (or the equivalent GPO/MDM setting) can import roots from the OS store (ImportEnterpriseRoots) and install additional CA files.

   {
     "policies": {
       "Certificates": {
         "ImportEnterpriseRoots": true,
         "Install": ["/etc/ssl/private-ca/corp-root-ca.pem"]
       }
     }
   }

2. 2.

   Site owners: send the full chain

   Configure the full-chain file; test with a client that does not cache intermediates, such as openssl.

   # Site owners: Firefox also caches intermediates, so test with a fresh client
   openssl s_client -connect www.example.com:443 -servername www.example.com -showcerts </dev/null 2>/dev/null \
     | grep -E '^ *[0-9]+ s:|^ *i:'

3. 3.

   Users: check the issuer before accepting the risk

   "Accept the Risk and Continue" adds a permanent exception for that certificate; only do it for your own devices on networks you control.

   Click "Advanced" → "View Certificate" and read the issuer before deciding anything:
   company or security-vendor name → trust that root via policy or Settings → Certificates;
   unknown issuer on a public network → do not accept the risk.

← Browse the full signature error database