The thing nobody explains: Firefox does not use your operating system
This is the single most useful fact about Firefox certificate warnings, and it explains most of the confusion around them.
Mozilla states it plainly:
Firefox uses the Mozilla CA store to verify that a connection is secure,
rather than certificates supplied by the user's operating system.Chrome and Edge on Windows lean on the system certificate store. Firefox ships and maintains its own.
Why that matters to you
It means Chrome and Firefox can genuinely disagree about the same site on the same computer, and both can be right.
A very common example: a certificate is installed on a server without its intermediate certificate. Chrome can often paper over that, because Windows may already have the missing piece cached from another site. Firefox will not, because it only trusts what is in the certificate authority list Mozilla maintains, plus whatever the server actually sends.
Another example: antivirus software or a workplace proxy that inspects encrypted traffic installs its own root certificate into Windows. Chrome accepts it. Firefox does not know about it, so Firefox breaks while everything else looks fine.
If someone tells you "it works in Chrome, so your certificate is fine", they are wrong. Firefox is the stricter test.
Firefox currently ships two different versions of this page
Worth knowing before you compare your screen to a screenshot online. Mozilla has been rolling out a redesigned warning, so which one you see depends on your version and on the rollout, not on the problem.
The classic page uses the title Warning: Potential Security Risk Ahead. When the site uses HSTS and the warning cannot be bypassed at all, the classic title is Did Not Connect: Potential Security Issue instead.
The redesigned page uses the title Warning: Security Risk with the heading Be careful. Something doesn't look right. It splits the explanation into two sections, What makes the site look dangerous? and What can you do about it?, and its buttons read Go back (Recommended) and Proceed to (hostname) (Risky).
Two small details that trip people up when searching. Firefox says (Risky) where Chrome says (unsafe). And the classic page labels the code Error code: while the redesigned page writes it Error Code:. The wording of the proceed action has changed over time, so trust what is on your own screen rather than an older guide.
Find the error code, because that is the real answer
The heading is the same for every certificate problem. The code underneath is what tells you which one you have. Expand the details on the warning page and look for it.
- →SEC_ERROR_UNKNOWN_ISSUER means Firefox cannot build a trusted chain. Unknown issuer, self-signed, or missing intermediate certificates. Full explanation here.
- →SEC_ERROR_EXPIRED_CERTIFICATE means the certificate ran out. It can also mean your device clock is wrong. Full explanation here.
- →SSL_ERROR_BAD_CERT_DOMAIN means the certificate is real but does not cover the address you visited. Full explanation here.
- →MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT means the certificate signed itself, so nothing independent vouches for it. See self-signed certificate.
- →SEC_ERROR_REVOKED_CERTIFICATE means the authority cancelled the certificate. Firefox will not let you continue past this one.
- →MOZILLA_PKIX_ERROR_MITM_DETECTED means something on your own computer or network is intercepting the connection. Usually antivirus or a corporate proxy, not an attacker.
Firefox has other pages for problems that are not certificates
If the title is not about a security risk, you are looking at a different fault.
Your Computer Clock is Wrong is Firefox telling you the certificate is probably fine and your device date is not. Check the clock before you touch anything else.
Software is Preventing Firefox From Safely Connecting to This Site means Firefox detected interception. Almost always antivirus HTTPS scanning or a workplace proxy.
Secure Connection Failed covers handshake problems rather than certificate problems. Firefox may add that the site "might not support the TLS 1.2 protocol, which is the minimum version supported by Firefox", which points at an old server. See TLS for what that means.
Firefox can also refuse a certificate that "couldn't prove it meets public certificate transparency requirements", which is a certificate issuance problem for the owner to resolve with their provider.
If it is your site, in order
Work from the code, not from guesses.
- 1.Read the error code on the Firefox page. It names the failing check directly, which saves a lot of time.
- 2.Test in Firefox specifically. A Chrome test can pass while Firefox fails, for the CA store reason above.
- 3.Check the full chain, not just the certificate. Missing intermediates are the most common cause of Firefox-only failures on otherwise healthy business sites.
- 4.Check every hostname you use. The bare domain, the www version, and any subdomain or checkout host all need to be covered.
- 5.Check renewal actually installed. Plenty of certificates renew successfully and then never get loaded by the web server until it restarts.
- 6.Confirm from outside. Run your address through our free check, or see the fixes for platform specific steps.
Frequently asked questions
Why does the site work in Chrome but not Firefox?
Because Firefox uses the Mozilla CA store to verify that a connection is secure, rather than certificates supplied by the user's operating system. Chrome and Edge on Windows use the system store, which may already contain a certificate Firefox has never seen. The usual real cause is a missing intermediate certificate on the server, and Firefox is simply the browser strict enough to catch it.
Is it safe to continue past the warning?
We would not. Firefox cannot tell the difference between a careless configuration and a genuine interception, and neither can you from the warning page. If you were about to log in or pay, stop there and come back once the site is fixed.
Why does my warning look different from the screenshots I found?
Firefox ships two designs of this page at the same time and which one you get depends on a rollout. The classic version is titled "Warning: Potential Security Risk Ahead". The redesigned version is titled "Warning: Security Risk" with the heading "Be careful. Something doesn't look right." Both are current.
Where is the error code?
Expand the details on the warning page. The classic design labels it "Error code:" and the redesigned one labels it "Error Code:". The code is the part worth searching, because the heading is identical for every certificate fault.
Firefox will not let me continue at all. Why?
Some cases cannot be overridden by design. A site using HSTS produces the "Did Not Connect: Potential Security Issue" page with no way through, and a revoked certificate is also final. That is deliberate, and the only fix is on the site owner's side.