Browser errors
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT: self-signed certificate
MOZILLA_PKIX_ERROR_SELF_SIGNED_CERTMOZILLA_PKIX_ERROR_SELF_SIGNED_CERT means the site presented a certificate that it signed itself, so no certificate authority vouches for it. That is expected on a home router or a test server you set up. On a public website it means the server is misconfigured or someone else is answering in its place.
Is it the site or your device?
On a public website it is usually the server; on your own router or test server it is expected. Run the SSL checker against the site:
curl ssl.sh/example.com
- The checker also sees a self-signed certificate: the server is configured that way. If you own it, replace the certificate. If you do not, do not enter any data.
- The checker sees a normal CA-issued certificate: your network is intercepting the connection. Public Wi-Fi portals, some proxies and malware present self-signed certificates. Switch to mobile data and compare.
Causes
1. Device default certificate
Routers, NAS boxes, IPMI consoles and printers generate a self-signed certificate at first boot. Reaching them by IP address or a .local name cannot use a public certificate anyway.
2. Web server default or snake-oil certificate
Some distributions install a placeholder certificate (for example Debian's ssl-cert-snakeoil). If a virtual host points to it, or the real certificate failed to load, visitors get the placeholder.
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -subject -issuer -fingerprint -sha256
Identical subject and issuer confirm a self-signed certificate.
3. Missing SNI match on a shared server
When the requested hostname has no matching server block, the default block may serve a self-signed certificate.
4. Interception
A captive portal or a proxy answering HTTPS requests may use a self-signed certificate. See captive portal errors.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead", "The certificate is not trusted because it is self-signed." |
| Chrome / Edge | NET::ERR_CERT_AUTHORITY_INVALID |
| Safari | "This Connection Is Not Private" |
| curl | SSL certificate problem: self-signed certificate |
How site owners fix it
A certificate from a public CA fixes it for internet-facing sites; internal systems need an internal CA whose root the devices trust.
1. Use a public certificate for anything on the internet.
sudo certbot --nginx -d example.com -d www.example.com
2. Point the server at the real files, not the placeholder:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
3. For internal systems, issue certificates from an internal CA and distribute its root through device management. For quick lab tests, the self-signed certificate generator creates a certificate with correct SAN entries.
4. Confirm with curl ssl.sh/example.com that the issuer is now a public CA.
FAQ
Is it OK to accept a self-signed certificate on my router?
Yes, if you are on your own network and you typed the router's address yourself. Ideally compare the certificate fingerprint with the one shown in the router's settings the first time. Do not accept self-signed certificates on public websites.
How can I stop the warning for an internal server?
Create a small private CA, sign the server certificate with it, and install the CA root on the devices that need access, or use a public certificate if the server has a public DNS name. Adding an exception per user does not scale and trains people to click through warnings.
Why does a big website suddenly show a self-signed certificate?
Something between you and the site is answering instead of the real server, such as a captive Wi-Fi portal, a misconfigured proxy, or malware. Do not continue. Switch networks and compare.
Can I get a public certificate for a device on my home network?
Yes, if you own a domain. Point a name such as nas.example.com at the device's private address and request a certificate with the DNS-01 challenge, which does not require the device to be reachable from the internet. Many NAS systems can renew such certificates automatically, which removes the self-signed warning for everyone on the network.