SEC_ERROR_UNKNOWN_ISSUER
We have upgraded to Firefox version 67 recently and the warning message SEC_ERROR_UNKNOWN_ISSUER was shown on every startup of our web application.
In our environment, we are using the root certificate generated by our enterprise.
Before upgrade, the warning message can be dismissed by applying the following policies in policies.json. But it does not work after upgrade. Anyone can help? Thanks. {
"policies": {
"Certificates": {
"ImportEnterpriseRoots": true
},
}
}
All Replies (3)
There is security software like Avast, Kaspersky, BitDefender and ESET that intercept secure connection certificates and send their own.
https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can
https://support.mozilla.org/en-US/kb/firefox-and-other-browsers-cant-load-websites
https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message
https://support.mozilla.org/en-US/kb/connection-untrusted-error-message
Websites don't load - troubleshoot and fix error messages
http://kb.mozillazine.org/Error_loading_websites
What do the security warning codes mean
- MOZILLA_PKIX_ERROR_MITM_DETECTED
- uses an invalid security certificate SSL_ERROR_BAD_CERT_DOMAIN
- configured their website improperly
How to troubleshoot the error code "SEC_ERROR_UNKNOWN_ISSUER" on secure websites https://support.mozilla.org/en-US/kb/troubleshoot-SEC_ERROR_UNKNOWN_ISSUER
Is the site certificate directly signed by the root certificate, or are there any intermediate certificates?
Firefox 67 added a feature to import intermediate certificates as well as roots, which I suppose could affect the validity of the certificate chain as a whole if there is conflicting information there, or the intermediates supersede the roots somehow. ??
A moderator can move this thread to the "Firefox for Enterprise" board where policy issues are best addressed.
Maybe try to remove existing intermediate certificates for this connection in the Certificate Manager to see if that has effect.