# SEC_ERROR_UNKNOWN_ISSUER in Firefox: causes and fixes

> SEC_ERROR_UNKNOWN_ISSUER means Firefox cannot trace the certificate to a trusted root: missing intermediate, private CA or HTTPS interception.

Source: https://ssl.sh/errors/sec-error-unknown-issuer/
Last updated: 2026-11-10

**SEC_ERROR_UNKNOWN_ISSUER means Firefox does not know or trust whoever issued this certificate.** On a single site it usually means the server sends an incomplete chain from a private CA, or a self-made certificate. On every site it means something on your device or network is intercepting HTTPS.

## Is it the site or your device?

If only one site fails, its chain is at fault; if all sites fail, something on your device intercepts HTTPS. Check the site from outside with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

- **The checker reports an incomplete chain or untrusted issuer:** the site has to fix its configuration.
- **The checker reports a valid chain:** click Advanced... > View Certificate in Firefox and look at the issuer. If it names an antivirus product, your employer, or a proxy, the problem is interception on your side. See [antivirus HTTPS scanning](https://ssl.sh/errors/antivirus-https-scanning-ssl-error/) and [corporate SSL inspection](https://ssl.sh/errors/corporate-ssl-inspection/).

## Causes

### 1. Missing intermediate certificate (most common on real websites)

The server sends only its own certificate. Firefox preloads intermediates of public CAs, which hides many of these mistakes, but private CAs, brand-new intermediates and some regional CAs still fail. Check what the server sends:

```bash
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null \
  | grep -E "^ *[0-9] s:|i:"
```

If you see only `0 s:` with no `1 s:` line, the chain is incomplete. See [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/).

### 2. Antivirus or proxy root not trusted by Firefox

HTTPS-scanning software and corporate proxies install their root in Windows or macOS. Firefox uses its own store, so unless the product also registers with Firefox or `security.enterprise_roots.enabled` is on, every site fails.

### 3. Private or self-issued CA

Internal portals signed by a company CA fail for anyone who has not installed that root. Distribute the root properly instead of asking users to accept exceptions.

### 4. Root not in Mozilla's store

A few CAs are trusted by Microsoft or Apple but not by Mozilla, or have been removed from Mozilla's program. Check the issuing CA and switch if necessary.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Firefox | "Warning: Potential Security Risk Ahead" and "the certificate issuer is unknown, the certificate is self-signed, or the server is not sending the correct intermediate certificates" |
| Chrome / Edge | [NET::ERR_CERT_AUTHORITY_INVALID](https://ssl.sh/errors/net-err-cert-authority-invalid/), or no error if Chrome repaired the chain |
| Safari | "This Connection Is Not Private" |
| curl / Python / Java | `unable to get local issuer certificate`, `CERTIFICATE_VERIFY_FAILED`, `PKIX path building failed` |

## How site owners fix it

Serving the leaf plus every intermediate, never the root, fixes it.

**1. Serve the full chain.** The leaf certificate comes first, then each intermediate, never the root. With Let's Encrypt this is `fullchain.pem`:

```nginx
ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
```

For a commercial certificate, concatenate in order:

```bash
cat example.com.crt intermediate.crt > example.com.fullchain.crt
```

**2. Build the chain automatically** with the [chain builder](https://ssl.sh/tools/chain-builder/) if you are unsure which intermediates you need.

**3. Verify with a strict client.** `curl ssl.sh/example.com` and a fresh Firefox profile should both succeed. Do not rely on Chrome alone, because it fixes chains silently.