Firefox SEC_ERROR_UNKNOWN_ISSUER fix for valid SSL certs

Missing Intermediate Certificate (most common)

I see this one all the time. The server has a valid certificate, but the webmaster forgot to bundle the intermediate certificate. Browsers like Chrome and Edge are forgiving — they'll try to fetch the missing intermediate from the internet. Firefox? Nope. It throws SEC_ERROR_UNKNOWN_ISSUER immediately.

Real story: Had a client last month whose e-commerce site was down in Firefox. Chrome worked fine. The hosting company had renewed the SSL but didn't include the intermediate chain. Took me 10 minutes to confirm with an SSL checker.

How to confirm this is the issue

1. Go to SSL Labs' SSL Server Test.
2. Enter the domain that's failing.
3. Look for "Chain issues – incomplete" or a warning about missing intermediate.

The fix (for the website owner)

If you control the server, you need to install the intermediate certificate. Exactly how depends on your web server:

• Apache: Use SSLCertificateChainFile or concatenate the intermediate with your cert in SSLCertificateFile (Apache 2.4.8+).
• Nginx: Concatenate your cert and the intermediate into one file, point ssl_certificate to it.
• cPanel/Plesk: Usually there's a "Install an SSL Certificate" wizard that lets you paste the intermediate separately.

If you don't control the server, send the site owner a link to this article. You can't fix this from your end.

# Nginx example: combine your cert and intermediate
cat your_domain.crt intermediate.crt > combined.crt
# Then in nginx.conf:
ssl_certificate /etc/ssl/certs/combined.crt;
ssl_certificate_key /etc/ssl/private/your_domain.key;

Local Security Software Blocking Firefox

Second most common cause — and it's a sneaky one. Antivirus suites like Norton, Avast, Bitdefender, and even some corporate firewalls do SSL inspection. They intercept HTTPS traffic and re-sign it with their own certificate. Firefox doesn't always trust that certificate.

I've seen this with Avast's "HTTPS Scanning" feature. It breaks Firefox on perfectly valid sites. Chrome and Edge use the system certificate store, so they usually work. Firefox has its own store, and security software forgets to add their cert there.

How to check if this is the cause

1. Open Firefox and go to Settings > Privacy & Security.
2. Scroll to Certificates and click View Certificates.
3. Look at the Authorities tab. Do you see your antivirus or firewall listed? Stuff like "Avast Web Shield", "Bitdefender SSL", "McAfee Web Gateway".
4. If you see one, that's your culprit.

The fix

• Option 1 (quick): Temporarily disable HTTPS scanning in your antivirus. Usually under Settings > Protection > Web Shield or similar. But I don't recommend leaving it off long-term.
• Option 2 (better): Force the security software to install its certificate into Firefox's trust store. Some have a "Repair" button. For others, you need to export the cert and import it manually:

1. Export the certificate from your antivirus (look for an export option in its settings).
2. In Firefox, go to Settings > Privacy & Security > Certificates > View Certificates.
3. Click the Import button under the Authorities tab.
4. Select the exported certificate file and check the box to trust it for websites.

Corrupted cert9.db or Certificate Store

Less common, but when it hits, it's a headache. Firefox stores its certificates in a file called cert9.db. If that file gets corrupt, you'll see SEC_ERROR_UNKNOWN_ISSUER on every HTTPS site.

I've seen this happen after a Firefox update that crashed midway, or when the user ran some registry cleaner that nuked Firefox's profile, or just random bitrot. The symptom is clear: all sites fail, not just one.

How to check

Open Firefox and try visiting three different major sites — google.com, github.com, and your bank. If all three throw the same error, your cert store is likely bad.

The fix

You need to reset the certificate store. Here's the step-by-step:

1. Close Firefox completely.
2. Open your profile folder:
   • Windows: Click Start, type %APPDATA%\Mozilla\Firefox\Profiles\ and hit Enter.
   • macOS: In Finder, go to ~/Library/Application Support/Firefox/Profiles/.
   • Linux: ~/.mozilla/firefox/
3. You'll see a folder with a random name ending in .default-release (or .default if you haven't created a new profile).
4. Inside that folder, find these files:
   • cert9.db
   • key4.db (optional but safe to remove)
5. Rename them to cert9.db.old and key4.db.old.
6. Start Firefox. It will create fresh copies of these files.

You'll lose any manually imported certificates, but that's usually fine. If you had custom CAs for work, you'll need to re-import them.

Quick-Reference Summary Table

That's it. Start with the missing intermediate check — it's the most common by far. If that's not it, move to security software. And if you're still stuck after both, nuke the db files. You'll be back online in five minutes.