MOZILLA_PKIX_ERROR_MITM_DETECTED: HTTPS is being intercepted

MOZILLA_PKIX_ERROR_MITM_DETECTED means Firefox believes something between you and the website is decrypting and re-signing your HTTPS traffic. The certificate Firefox received was not issued by the site's real CA but by a root installed by security software, a company proxy, or something you did not install. The website is not at fault.

Is it the site or your device?

It is your device or network. Confirm the real certificate with the SSL checker:

curl ssl.sh/example.com

Then click Advanced... > View Certificate on Firefox's warning page and compare the issuer. If the checker shows a public CA and Firefox shows something else (for example a name containing an antivirus brand, "Proxy", "Inspection" or your company name), you have found the interceptor.

Causes

1. Antivirus HTTPS scanning

Many security suites include web protection that scans encrypted traffic. When their root is not in Firefox's store, Firefox reports interception. Update the product, repair its browser integration, or turn off HTTPS scanning. Details in antivirus HTTPS scanning.

2. Corporate SSL inspection

Company firewalls and secure web gateways decrypt traffic for policy and malware scanning. IT should deploy the inspection root to Firefox through enterprise policy. See corporate SSL inspection.

3. Parental control or network filtering software

Home filtering tools and some routers use the same technique. Check their settings for an HTTPS filtering option.

4. Malware or adware

Some unwanted software installs a root to inject ads or steal data. If you cannot identify the issuer, check installed programs and browser extensions, run a reputable malware scanner, and remove unknown roots from the operating system store.

5. Debugging proxies

Developer tools that intercept HTTPS for debugging install their own root. Close the tool or trust its root only in a dedicated testing profile.

What it looks like in each browser

Browser	What you see
Firefox	"Warning: Potential Security Risk Ahead" with `MOZILLA_PKIX_ERROR_MITM_DETECTED` and a note that software on your device or network may be intercepting the connection
Chrome / Edge	Usually loads normally (they trust operating system roots), or NET::ERR_CERT_AUTHORITY_INVALID if the root is missing there too
Safari	Loads if the root is trusted in the keychain

How site owners fix it

The interception happens on the user's side, so site owners only confirm their chain and explain the cause.

1. Nothing to change on the server if curl ssl.sh/example.com shows a valid public chain. Explain to affected users that the interception is local.

2. For IT administrators deploying inspection: distribute the root to Firefox explicitly. A minimal policies.json:

{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    }
  }
}

3. Exclude sensitive destinations such as banking, health and certificate-pinned apps from inspection, which also reduces breakage.

FAQ

Does MITM_DETECTED mean I have been hacked?

Usually not. In most cases it is your own antivirus or your employer's security system. But if you do not recognise the issuer name and have no such software, treat it as possible malware: scan the computer and change passwords from a clean device.

Should I enable security.enterprise_roots.enabled?

On a work computer where IT deliberately inspects traffic, yes, or better, ask IT to deploy the root through Firefox policy. On a personal computer, enable it only after confirming the extra root belongs to software you installed on purpose.

Why do Chrome and Edge not complain?

They trust roots added to the operating system, which is where interception software installs its certificate. Firefox uses its own root store, so it notices the substitution.

Will the website owner see this error?

No. The site is not involved; the certificate Firefox received never came from it. Our checker will show the real certificate when you run curl ssl.sh/example.com.