Browser errors
Site works in Chrome but Firefox says SEC_ERROR_UNKNOWN_ISSUER
SEC_ERROR_UNKNOWN_ISSUER (only in Firefox)When a site opens in Chrome or Edge but Firefox shows SEC_ERROR_UNKNOWN_ISSUER, the two browsers are trusting different sets of root certificates or building the chain differently. Firefox uses Mozilla's own root store and does not download missing intermediates; Chromium browsers also trust roots added to the operating system and fetch intermediates on their own.
Is it the site or your device?
It can be either: a site with an incomplete chain, or a root that only your operating system trusts. Run the SSL checker, which behaves like a strict client:
curl ssl.sh/example.com
- The checker flags the chain: the site is misconfigured, and Chrome is hiding it. The site owner should fix the chain.
- The checker passes: the difference is on your computer. In Firefox, click Advanced... > View Certificate and read the issuer. A name of an antivirus product, a company or a proxy means a locally installed root that Firefox does not trust.
Causes
1. Antivirus or security software root missing from Firefox
HTTPS-scanning products install their root into the operating system store. Many also register it with Firefox; if that step failed, only Firefox complains. Firefox may instead show MOZILLA_PKIX_ERROR_MITM_DETECTED. Repair or update the product, or turn off its HTTPS scanning.
2. Company root deployed only to the operating system
IT deployed the corporate CA through Group Policy or MDM, but not to Firefox. Fix it centrally with a Firefox enterprise policy (Certificates > ImportEnterpriseRoots or Install), or locally by enabling enterprise roots:
about:config -> security.enterprise_roots.enabled -> true
3. Private CA site without its intermediate
Chrome fetched the intermediate through the AIA URL; Firefox did not, and its intermediate preloading covers only public CAs. The site must send the full chain. See missing intermediate certificate.
4. Root trusted by Microsoft or Apple but not by Mozilla
Root programs differ. A CA present only in the Windows or Apple store fails in Firefox. Check the issuer against Mozilla's CA program and switch CA if needed.
5. Development tools
Local HTTPS tools often install a development root into the system store. Import the same root into Firefox, or enable enterprise roots on the development machine.
What it looks like in each browser
| Browser | Result |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead" with SEC_ERROR_UNKNOWN_ISSUER |
| Chrome / Edge | Page loads, padlock shown |
| Safari | Usually loads if the root is in the macOS keychain |
| curl / Python | Fails if the chain is incomplete; succeeds if the site is fine and no interception is involved |
How site owners fix it
A complete chain from a CA in Mozilla's root store fixes it for public sites; internal sites also need their root deployed to Firefox.
1. Serve the complete chain. Use the full-chain file and verify with a strict client:
ssl_certificate /etc/nginx/ssl/example.com.fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
The chain builder produces the right bundle.
2. Use a CA trusted by all major root programs for public sites.
3. For internal sites, deploy your root to Firefox explicitly through policy, not only to the operating system. Then test with curl ssl.sh/example.com (for public names) and a clean Firefox profile.
FAQ
Is it safe to enable security.enterprise_roots.enabled?
It makes Firefox trust every root that you or an administrator added to the operating system, which is what Chrome and Edge already do. It is appropriate on a managed work computer. On a personal computer, first check which extra roots are installed and remove any you do not recognise.
Chrome trusts it, so the certificate must be fine, right?
Not necessarily. Chrome may be trusting a local interception root or have quietly fetched a missing intermediate. Run curl ssl.sh/example.com: if our checker also flags the chain, the site needs fixing regardless of what Chrome shows.
How do I see which certificate Firefox received?
On the warning page click Advanced..., then View Certificate. The issuer of the first certificate tells you whether it came from a public CA, your company, or a security product.