# MOZILLA_PKIX_ERROR_MITM_DETECTED: HTTPS is being intercepted

> Firefox shows MOZILLA_PKIX_ERROR_MITM_DETECTED when antivirus, a proxy or malware intercepts HTTPS with an untrusted root. How to identify and fix it.

Source: https://ssl.sh/errors/mozilla-pkix-error-mitm-detected/
Last updated: 2026-11-10

**MOZILLA_PKIX_ERROR_MITM_DETECTED means Firefox believes something between you and the website is decrypting and re-signing your HTTPS traffic.** The certificate Firefox received was not issued by the site's real CA but by a root installed by security software, a company proxy, or something you did not install. The website is not at fault.

## Is it the site or your device?

It is your device or network. Confirm the real certificate with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

Then click **Advanced... > View Certificate** on Firefox's warning page and compare the issuer. If the checker shows a public CA and Firefox shows something else (for example a name containing an antivirus brand, "Proxy", "Inspection" or your company name), you have found the interceptor.

## Causes

### 1. Antivirus HTTPS scanning

Many security suites include web protection that scans encrypted traffic. When their root is not in Firefox's store, Firefox reports interception. Update the product, repair its browser integration, or turn off HTTPS scanning. Details in [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/).

### 2. Corporate SSL inspection

Company firewalls and secure web gateways decrypt traffic for policy and malware scanning. IT should deploy the inspection root to Firefox through enterprise policy. See [corporate SSL inspection](https://ssl.sh/errors/corporate-ssl-inspection/).

### 3. Parental control or network filtering software

Home filtering tools and some routers use the same technique. Check their settings for an HTTPS filtering option.

### 4. Malware or adware

Some unwanted software installs a root to inject ads or steal data. If you cannot identify the issuer, check installed programs and browser extensions, run a reputable malware scanner, and remove unknown roots from the operating system store.

### 5. Debugging proxies

Developer tools that intercept HTTPS for debugging install their own root. Close the tool or trust its root only in a dedicated testing profile.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead" with `MOZILLA_PKIX_ERROR_MITM_DETECTED` and a note that software on your device or network may be intercepting the connection |
| Chrome / Edge | Usually loads normally (they trust operating system roots), or [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/) if the root is missing there too |
| Safari | Loads if the root is trusted in the keychain |

## How site owners fix it

The interception happens on the user's side, so site owners only confirm their chain and explain the cause.

**1. Nothing to change on the server** if `curl ssl.sh/example.com` shows a valid public chain. Explain to affected users that the interception is local.

**2. For IT administrators deploying inspection:** distribute the root to Firefox explicitly. A minimal `policies.json`:

```json
{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    }
  }
}
```

**3. Exclude sensitive destinations** such as banking, health and certificate-pinned apps from inspection, which also reduces breakage.