# Site works in Chrome but Firefox says SEC_ERROR_UNKNOWN_ISSUER

> Why a site opens in Chrome or Edge but Firefox reports SEC_ERROR_UNKNOWN_ISSUER: separate root stores, enterprise roots, antivirus and private CAs.

Source: https://ssl.sh/errors/firefox-sec-error-unknown-issuer-only/
Last updated: 2026-11-10

**When a site opens in Chrome or Edge but Firefox shows SEC_ERROR_UNKNOWN_ISSUER, the two browsers are trusting different sets of root certificates or building the chain differently.** Firefox uses Mozilla's own root store and does not download missing intermediates; Chromium browsers also trust roots added to the operating system and fetch intermediates on their own.

## Is it the site or your device?

It can be either: a site with an incomplete chain, or a root that only your operating system trusts. Run the [SSL checker](https://ssl.sh/tools/ssl-checker/), which behaves like a strict client:

```bash
curl ssl.sh/example.com
```

- **The checker flags the chain:** the site is misconfigured, and Chrome is hiding it. The site owner should fix the chain.
- **The checker passes:** the difference is on your computer. In Firefox, click **Advanced... > View Certificate** and read the issuer. A name of an antivirus product, a company or a proxy means a locally installed root that Firefox does not trust.

## Causes

### 1. Antivirus or security software root missing from Firefox

HTTPS-scanning products install their root into the operating system store. Many also register it with Firefox; if that step failed, only Firefox complains. Firefox may instead show [MOZILLA_PKIX_ERROR_MITM_DETECTED](https://ssl.sh/errors/mozilla-pkix-error-mitm-detected/). Repair or update the product, or turn off its HTTPS scanning.

### 2. Company root deployed only to the operating system

IT deployed the corporate CA through Group Policy or MDM, but not to Firefox. Fix it centrally with a Firefox enterprise policy (`Certificates` > `ImportEnterpriseRoots` or `Install`), or locally by enabling enterprise roots:

```text
about:config  ->  security.enterprise_roots.enabled  ->  true
```

### 3. Private CA site without its intermediate

Chrome fetched the intermediate through the AIA URL; Firefox did not, and its intermediate preloading covers only public CAs. The site must send the full chain. See [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/).

### 4. Root trusted by Microsoft or Apple but not by Mozilla

Root programs differ. A CA present only in the Windows or Apple store fails in Firefox. Check the issuer against Mozilla's CA program and switch CA if needed.

### 5. Development tools

Local HTTPS tools often install a development root into the system store. Import the same root into Firefox, or enable enterprise roots on the development machine.

## What it looks like in each browser

| Browser | Result |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead" with `SEC_ERROR_UNKNOWN_ISSUER` |
| Chrome / Edge | Page loads, padlock shown |
| Safari | Usually loads if the root is in the macOS keychain |
| curl / Python | Fails if the chain is incomplete; succeeds if the site is fine and no interception is involved |

## How site owners fix it

A complete chain from a CA in Mozilla's root store fixes it for public sites; internal sites also need their root deployed to Firefox.

**1. Serve the complete chain.** Use the full-chain file and verify with a strict client:

```nginx
ssl_certificate     /etc/nginx/ssl/example.com.fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
```

The [chain builder](https://ssl.sh/tools/chain-builder/) produces the right bundle.

**2. Use a CA trusted by all major root programs** for public sites.

**3. For internal sites,** deploy your root to Firefox explicitly through policy, not only to the operating system. Then test with `curl ssl.sh/example.com` (for public names) and a clean Firefox profile.