What Firefox actually says
Under the heading, Firefox spells out all three possibilities in one sentence:
...does not trust <host> because its certificate issuer is unknown,
the certificate is self-signed, or the server is not sending the
correct intermediate certificates.Three different faults share one code. Which one you have decides the fix, so it is worth telling them apart.
The three causes, and how common each really is
They are not equally likely.
- →The server is not sending the correct intermediate certificates. The most common cause on legitimate business sites. The certificate itself is valid and paid for, but the middle link of the chain was never installed, so Firefox cannot get from the site to a trusted root.
- →The certificate is self-signed. It vouches for itself, so nothing independent backs it. Normal for test servers and internal tools, never acceptable for a public site.
- →The issuer is genuinely unknown. A private or company-internal authority, an appliance with its own certificate, or software on the connection presenting a certificate Firefox has never heard of.
Why this hits Firefox and not Chrome
This is the part that confuses people, and it has a clean explanation. Mozilla puts it directly:
Firefox uses the Mozilla CA store to verify that a connection is secure,
rather than certificates supplied by the user's operating system.Chrome and Edge on Windows lean on the system store, which may already hold the intermediate your server forgot to send.
What that means in practice
When your server omits an intermediate, Chrome on Windows can sometimes fill the gap from a copy the operating system picked up elsewhere. Firefox will not. It uses Mozilla's own list and what your server sends, and nothing else.
So "it works in Chrome" is not evidence your certificate is installed correctly. It only means Chrome found the missing piece somewhere. Another visitor, on a fresh machine or a phone, may see the same failure you see in Firefox.
The background is explained on our Warning: Potential Security Risk Ahead page, and Chrome's equivalent code is NET::ERR_CERT_AUTHORITY_INVALID.
When it is your own antivirus or workplace network
There is a related code worth knowing, because it turns a frightening warning into a boring one.
If Firefox shows MOZILLA_PKIX_ERROR_MITM_DETECTED, the page title becomes Software is Preventing Firefox From Safely Connecting to This Site. That is Firefox telling you something between you and the site is opening the encrypted connection and re-signing it.
In practice that is almost always antivirus software with HTTPS or TLS scanning switched on, or a corporate proxy on an office or school network. It is very rarely an actual attacker. If you get it on every site rather than one, that is the tell.
Two useful signs it is local to you: the same site loads fine on your phone over mobile data, or the problem started right after a security product was installed or updated.
If it is your site, in order
Diagnose before you reissue anything. Reissuing a certificate does not fix a chain that is not being served.
- 1.Test in Firefox, not Chrome. Chrome can hide exactly the fault you are trying to find.
- 2.Check the served chain, not the certificate file. The question is what your web server hands to visitors, which is not always what you uploaded.
- 3.Install the intermediate bundle your provider supplied. Most providers give you the certificate and a chain or bundle file. The bundle is the part people skip.
- 4.Reload or restart the web server. A corrected chain that was never reloaded is still the old chain.
- 5.Check every host and every server. Behind a load balancer or a CDN, one node with the old configuration produces intermittent reports that are hard to reproduce.
- 6.Replace any self-signed or internal certificate on a public site with one from a public authority. Read what an SSL certificate is if you want the background first.
- 7.Confirm from outside your network with our free check, which sees your site the way a stranger does.
Frequently asked questions
Does this mean the site is dangerous?
Not necessarily. It means Firefox cannot verify who issued the certificate, so it cannot confirm the site is who it claims to be. Most cases are a missing intermediate certificate on a legitimate site. From the warning page you cannot tell the difference, so do not enter anything sensitive until it loads properly.
Why does the site load fine in Chrome?
Firefox uses the Mozilla CA store to verify that a connection is secure, rather than certificates supplied by the user's operating system. Chrome on Windows can borrow a missing intermediate from the system store. Firefox cannot, so it fails where Chrome quietly succeeds. The server is still misconfigured either way.
What is an intermediate certificate?
It is the middle link between your site's certificate and the trusted root. Authorities do not sign site certificates with their root directly, so your server has to send the intermediate as well. If it does not, the browser has a chain with a hole in it and rejects the whole thing.
I get this on every site, not just one. What is going on?
That points at your own computer or network rather than the sites. Antivirus HTTPS scanning and corporate proxies both intercept encrypted traffic and can trigger this, along with the related MOZILLA_PKIX_ERROR_MITM_DETECTED code and its "Software is Preventing Firefox From Safely Connecting to This Site" page. Test the same site on mobile data to confirm.
Should I add an exception to make it go away?
Not on a public site you did not build. The exception silences the check without fixing anything, and it stays silenced. If it is your own test server, that is your call. If it is a shop, wait for the owner to fix it.