How to Fix SEC_ERROR_UNKNOWN_ISSUER in Mozilla Firefox

Why Does Firefox Show SEC_ERROR_UNKNOWN_ISSUER?

Mozilla Firefox uses its own built-in certificate trust store (Network Security Services - NSS) rather than the underlying Windows or macOS operating system certificate store.

This causes two common failure modes:

1. Missing Intermediate CA on Web Server: Chrome may automatically download missing intermediate CAs via AIA (Authority Information Access) fetching, but Firefox strictly enforces the server providing the full chain.
2. Antivirus HTTPS Scanning: Antivirus programs (Avast, AVG, Bitdefender, Kaspersky) intercept encrypted web traffic using a locally installed root certificate. If Firefox does not have this certificate in its NSS database, all HTTPS connections fail.

How Webmasters Can Fix It

Always point your web server to fullchain.pem containing both the server certificate and intermediate CA:

ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;