Browser errors
"Warning: Potential Security Risk Ahead" in Firefox: fixes
Warning: Potential Security Risk Ahead"Warning: Potential Security Risk Ahead" means Firefox could not confirm the site's certificate and stopped before loading the page. The headline is the same for several different problems; the code shown after clicking Advanced... tells you which one you have.
Is it the site or your device?
Most often it is the site's certificate; a valid result from an outside check points to your device instead. Test the site independently with the SSL checker:
curl ssl.sh/example.com
- The checker finds a problem (expired, wrong name, untrusted issuer): it is the site's certificate. Visitors should not bypass the warning on any site that handles logins or payments.
- The checker shows a valid certificate: the cause is local. Check the date on your computer, then whether antivirus software or a company proxy is intercepting HTTPS. Firefox detects many of those cases and shows
MOZILLA_PKIX_ERROR_MITM_DETECTED.
Causes
The most frequent code is SEC_ERROR_UNKNOWN_ISSUER, followed by SSL_ERROR_BAD_CERT_DOMAIN and SEC_ERROR_EXPIRED_CERTIFICATE. Match the code under Advanced... to the list below.
1. SEC_ERROR_UNKNOWN_ISSUER
Firefox cannot link the certificate to a trusted root: a missing intermediate on a private CA, a self-issued certificate, or an interception root unknown to Firefox. See SEC_ERROR_UNKNOWN_ISSUER.
2. SSL_ERROR_BAD_CERT_DOMAIN
The certificate is for another hostname. See SSL_ERROR_BAD_CERT_DOMAIN.
3. SEC_ERROR_EXPIRED_CERTIFICATE
Expired certificate, or your clock is wrong. See SEC_ERROR_EXPIRED_CERTIFICATE.
4. MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
The certificate signed itself, typical for routers and test servers. See self-signed certificate.
5. MOZILLA_PKIX_ERROR_MITM_DETECTED
Security software or a proxy is intercepting the connection. See MITM detected.
Other codes
SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE (an intermediate expired), MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE (clock behind), and SEC_ERROR_INADEQUATE_KEY_USAGE also appear here.
What it looks like in each browser
| Browser | Equivalent page |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead"; on HSTS sites "Did Not Connect: Potential Security Issue" |
| Firefox (protocol errors) | "Secure Connection Failed", for codes such as PR_END_OF_FILE_ERROR |
| Chrome / Edge | "Your connection is not private" |
| Safari | "This Connection Is Not Private" |
How site owners fix it
A complete, valid chain that covers every hostname fixes the warning for all Firefox users.
1. Reproduce outside the browser. curl ssl.sh/example.com shows which check fails. Firefox is a good test client because it does not download missing intermediates through AIA, although it preloads intermediates of public CAs.
2. Serve a complete, valid chain. For Nginx, use the full-chain file:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
The chain builder generates the right bundle if your CA only gave you the leaf.
3. Cover every hostname in the SAN list and renew before expiry; automate it with ACME.
4. Test in Firefox after each change. A private window avoids cached exceptions. If you previously accepted an exception for the site, delete it under Settings > Certificates > View Certificates > Servers before testing.
FAQ
Should I click "Accept the Risk and Continue"?
Only for a device or service you run yourself, like a home router or a test server, where you know why the certificate is untrusted. For banks, shops, email and anything with a login, go back and let the site owner fix it.
Why does Chrome open the site but Firefox warns?
Firefox has its own root store and does not import roots added to Windows or macOS unless enterprise roots are enabled. Antivirus or company roots are the usual reason. See only Firefox shows SEC_ERROR_UNKNOWN_ISSUER.
How do I remove an exception I added by mistake?
Open Settings, search for "Certificates", click View Certificates, select the Servers tab, and delete the entry for that site. Firefox will warn again on the next visit.
Why is there no "Accept the Risk" button on some sites?
The site uses HSTS, either through a Strict-Transport-Security header you received earlier or because it is on the HSTS preload list built into Firefox. For those sites Firefox shows "Did Not Connect: Potential Security Issue" and refuses any exception, because the owner has declared that the site must always have a valid certificate. The only fix is on the site's side, or correcting your clock or interception software. See HSTS errors.