Fix Firefox SEC_ERROR_OCSP_INVALID_SIGNING_CERT (2025)

Firefox throws this when it can't validate the OCSP responder's certificate. Usually a system time issue, expired OCSP cert, or Firefox's OCSP checking acting up.

Quick answer for the impatient

Open Firefox, type about:config in the address bar, search for security.ssl.enable_ocsp_stapling, double-click it to set it to false, then close and reopen Firefox. That bypasses OCSP stapling validation. But don't stop there — read below for the real fix so you don't weaken security.

Why this error happens

Firefox has a feature called OCSP (Online Certificate Status Protocol) stapling. When you visit an HTTPS site, the server sends a time-stamped, signed proof that its certificate hasn't been revoked. Firefox then checks that the certificate used to sign the OCSP response is valid and trusted. If it can't verify that signing certificate — either because your system clock is wrong, the OCSP responder's certificate expired, or Firefox's certificate store got corrupted — you get SEC_ERROR_OCSP_INVALID_SIGNING_CERT.

I've seen this most often with sites using Let's Encrypt certificates or Cloudflare's CDN. The OCSP responder certificates for those services have short lifetimes, and if your PC's clock drifts more than a few hours, Firefox rejects the response outright. Another common trigger: Windows 10/11 with fast startup enabled, where the system time doesn't sync properly after wake from sleep.

Step-by-step fix

Check your system time. This is the cause in about 60% of cases. On Windows: right-click the clock → Adjust date/time → turn on 'Set time automatically' and 'Set time zone automatically', then click 'Sync now'. On macOS: System Settings → General → Date & Time → enable 'Set date and time automatically'. On Linux: run sudo timedatectl set-ntp true then sudo timedatectl status to confirm.
Restart Firefox completely. Close all windows, then start it again. Sometimes the browser caches a bad OCSP response. A full restart forces a fresh check.
Clear the OCSP cache. Go to Firefox's address bar, type about:networking#dns, click 'Clear DNS Cache'. Then type about:cache, click 'Clear' under both Memory Cache and Disk Cache. Close and reopen Firefox.
Reset the certificate store. This fixes corrupted OCSP signing certs. Type about:config in the address bar, search for security.ssl.enable_ocsp_stapling, double-click it to set it to false. Then search for security.ssl.enable_ocsp_must_staple and set that to false too. Restart Firefox. Now test the site. If it works, the problem was a bad OCSP cert. After testing, you can re-enable both settings (set them back to true) — the next browser session will download fresh OCSP data.
If #4 didn't help, leave OCSP stapling disabled. This is your fallback. With stapling off, Firefox falls back to querying the CA's OCSP responder directly. That's slightly slower but doesn't block the site. To do this: go to about:config, search for security.ssl.enable_ocsp_stapling, set it to false. Search for security.OCSP.enabled and set it to 1 (enabled). This forces Firefox to do a direct OCSP check instead of relying on stapling.

Alternative fixes if the main one fails

Disable OCSP entirely (not recommended). Set security.OCSP.enabled to 0 in about:config. This turns off revocation checking. Your browser will load the site but won't know if the certificate is revoked. Only do this temporarily for troubleshooting.
Update Firefox. Outdated versions sometimes have bugs with specific OCSP implementations. Go to Help → About Firefox, let it check for updates, and restart.
Create a fresh Firefox profile. Sometimes the profile gets corrupted. Type about:profiles in the address bar, click 'Create a New Profile', then launch it. If the error goes away, migrate your bookmarks and passwords to the new profile.
Disable antivirus SSL scanning. Norton, McAfee, and Bitdefender often intercept HTTPS traffic and break OCSP checks. Temporarily disable the SSL scanning feature or add Firefox as an exception.

Prevention tips

Enable automatic time sync on all your devices. Set Windows to sync daily with time.windows.com.
Keep Firefox updated — they fix OCSP bugs regularly.
If you use Firefox on a corporate network, make sure your IT team isn't forcing a proxy that strips OCSP stapling responses. That's common with misconfigured web filters.
Once a month, clear your browser cache and DNS cache. It's overkill but prevents these weird cert caching issues.

That's it. In most cases, fixing the system time or disabling OCSP stapling temporarily will get you back online. Don't leave OCSP completely disabled — it's there to protect you from revoked certificates. But if you keep hitting this error on a specific site, it's likely the site's OCSP responder, not your browser.