# "Warning: Potential Security Risk Ahead" in Firefox: fixes

> Firefox shows "Warning: Potential Security Risk Ahead" when a certificate check fails. The error code under Advanced tells you the cause and fix.

Source: https://ssl.sh/errors/firefox-potential-security-risk-ahead/
Last updated: 2026-11-10

**"Warning: Potential Security Risk Ahead" means Firefox could not confirm the site's certificate and stopped before loading the page.** The headline is the same for several different problems; the code shown after clicking Advanced... tells you which one you have.

## Is it the site or your device?

Most often it is the site's certificate; a valid result from an outside check points to your device instead. Test the site independently with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker finds a problem** (expired, wrong name, untrusted issuer): it is the site's certificate. Visitors should not bypass the warning on any site that handles logins or payments.
- **The checker shows a valid certificate:** the cause is local. Check the date on your computer, then whether antivirus software or a company proxy is intercepting HTTPS. Firefox detects many of those cases and shows `MOZILLA_PKIX_ERROR_MITM_DETECTED`.

## Causes

The most frequent code is SEC_ERROR_UNKNOWN_ISSUER, followed by SSL_ERROR_BAD_CERT_DOMAIN and SEC_ERROR_EXPIRED_CERTIFICATE. Match the code under Advanced... to the list below.

### 1. SEC_ERROR_UNKNOWN_ISSUER

Firefox cannot link the certificate to a trusted root: a missing intermediate on a private CA, a self-issued certificate, or an interception root unknown to Firefox. See [SEC_ERROR_UNKNOWN_ISSUER](https://ssl.sh/errors/sec-error-unknown-issuer/).

### 2. SSL_ERROR_BAD_CERT_DOMAIN

The certificate is for another hostname. See [SSL_ERROR_BAD_CERT_DOMAIN](https://ssl.sh/errors/ssl-error-bad-cert-domain/).

### 3. SEC_ERROR_EXPIRED_CERTIFICATE

Expired certificate, or your clock is wrong. See [SEC_ERROR_EXPIRED_CERTIFICATE](https://ssl.sh/errors/sec-error-expired-certificate/).

### 4. MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

The certificate signed itself, typical for routers and test servers. See [self-signed certificate](https://ssl.sh/errors/mozilla-pkix-error-self-signed-cert/).

### 5. MOZILLA_PKIX_ERROR_MITM_DETECTED

Security software or a proxy is intercepting the connection. See [MITM detected](https://ssl.sh/errors/mozilla-pkix-error-mitm-detected/).

### Other codes

`SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE` (an intermediate expired), `MOZILLA_PKIX_ERROR_NOT_YET_VALID_CERTIFICATE` (clock behind), and [SEC_ERROR_INADEQUATE_KEY_USAGE](https://ssl.sh/errors/sec-error-inadequate-key-usage/) also appear here.

## What it looks like in each browser

| Browser | Equivalent page |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead"; on HSTS sites "Did Not Connect: Potential Security Issue" |
| Firefox (protocol errors) | "Secure Connection Failed", for codes such as [PR_END_OF_FILE_ERROR](https://ssl.sh/errors/pr-end-of-file-error/) |
| Chrome / Edge | ["Your connection is not private"](https://ssl.sh/errors/your-connection-is-not-private/) |
| Safari | ["This Connection Is Not Private"](https://ssl.sh/errors/safari-this-connection-is-not-private/) |

## How site owners fix it

A complete, valid chain that covers every hostname fixes the warning for all Firefox users.

**1. Reproduce outside the browser.** `curl ssl.sh/example.com` shows which check fails. Firefox is a good test client because it does not download missing intermediates through AIA, although it preloads intermediates of public CAs.

**2. Serve a complete, valid chain.** For Nginx, use the full-chain file:

```nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
```

The [chain builder](https://ssl.sh/tools/chain-builder/) generates the right bundle if your CA only gave you the leaf.

**3. Cover every hostname** in the SAN list and renew before expiry; automate it with ACME.

**4. Test in Firefox after each change.** A private window avoids cached exceptions. If you previously accepted an exception for the site, delete it under Settings > Certificates > View Certificates > Servers before testing.