Is SEC_ERROR_UNKNOWN_ISSUER dangerous?

It means Firefox cannot verify who issued the certificate, so it cannot rule out an impersonator. On public sites that ask for passwords or payment, do not accept the risk. On your own router or test server it is usually harmless.

Chrome opens the site fine. Who is right?

Both can be right. Chrome may have repaired a missing intermediate on its own, or it may trust a root added to Windows or macOS that Firefox does not use. The server should still be fixed so every client works. See only Firefox shows this error.

How do I make Firefox trust my company's root certificate?

Ask IT to deploy it through enterprise policy, or import it under Settings > Privacy & Security > Certificates > View Certificates > Authorities > Import. Alternatively set security.enterprise_roots.enabled to true in about:config so Firefox reads roots that IT installed into the operating system.

SEC_ERROR_UNKNOWN_ISSUER in Firefox: causes and fixes

SEC_ERROR_UNKNOWN_ISSUER means Firefox does not know or trust whoever issued this certificate. On a single site it usually means the server sends an incomplete chain from a private CA, or a self-made certificate. On every site it means something on your device or network is intercepting HTTPS.

Is it the site or your device?

If only one site fails, its chain is at fault; if all sites fail, something on your device intercepts HTTPS. Check the site from outside with the SSL checker:

curl ssl.sh/example.com

The checker reports an incomplete chain or untrusted issuer: the site has to fix its configuration.
The checker reports a valid chain: click Advanced... > View Certificate in Firefox and look at the issuer. If it names an antivirus product, your employer, or a proxy, the problem is interception on your side. See antivirus HTTPS scanning and corporate SSL inspection.

Causes

1. Missing intermediate certificate (most common on real websites)

The server sends only its own certificate. Firefox preloads intermediates of public CAs, which hides many of these mistakes, but private CAs, brand-new intermediates and some regional CAs still fail. Check what the server sends:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null \
  | grep -E "^ *[0-9] s:|i:"

If you see only 0 s: with no 1 s: line, the chain is incomplete. See missing intermediate certificate.

2. Antivirus or proxy root not trusted by Firefox

HTTPS-scanning software and corporate proxies install their root in Windows or macOS. Firefox uses its own store, so unless the product also registers with Firefox or security.enterprise_roots.enabled is on, every site fails.

3. Private or self-issued CA

Internal portals signed by a company CA fail for anyone who has not installed that root. Distribute the root properly instead of asking users to accept exceptions.

4. Root not in Mozilla's store

A few CAs are trusted by Microsoft or Apple but not by Mozilla, or have been removed from Mozilla's program. Check the issuing CA and switch if necessary.

What it looks like in each browser

Browser	What you see
Firefox	"Warning: Potential Security Risk Ahead" and "the certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates"
Chrome / Edge	NET::ERR_CERT_AUTHORITY_INVALID, or no error if Chrome repaired the chain
Safari	"This Connection Is Not Private"
curl / Python / Java	`unable to get local issuer certificate`, `CERTIFICATE_VERIFY_FAILED`, `PKIX path building failed`

How site owners fix it

Serving the leaf plus every intermediate, never the root, fixes it.

1. Serve the full chain. The leaf certificate comes first, then each intermediate, never the root. With Let's Encrypt this is fullchain.pem:

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

For a commercial certificate, concatenate in order:

cat example.com.crt intermediate.crt > example.com.fullchain.crt

2. Build the chain automatically with the chain builder if you are unsure which intermediates you need.

3. Verify with a strict client. curl ssl.sh/example.com and a fresh Firefox profile should both succeed. Do not rely on Chrome alone, because it fixes chains silently.