Mozilla Invalid Security Certificate

Posted on  by



  1. Addons.mozilla.org Uses An Invalid Security Certificate
  2. Mozilla Invalid Security Certificate
  3. Mozilla Invalid Security Certificate Status
  4. Mozilla Firefox Invalid Security Certificate Error
Our volunteers are working on translating this article. Until it's ready, maybe the English version can be of some help. If you want to help us translate articles like this one, please click here.

Sometimes when browsing the web random sites have invalid security certificates. Firefox makes a really big deal out of this (which is good if you think you're visiting your bank or something) but it seems that the only way to successfully get to a site with an invalid security certificate is to add a (permanent) exception. This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox may only connect to it securely. As a result, it is not possible to add an exception for this certificate. Www.google.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The certificate is only valid for 192.168.168.168 (Error code: sslerrorbadcertdomain) Expected results: The SSL certificate used for contains the following attributes: Subject: CN = vpn.hera.hr, O = HERA, L = Zagreb, S = Croatia, C = HR Subject Alternative Name: IP Address=192.168.168.168 So, the certificate should not be declared invalid. It seems that Firefox declares it invalid. Uses an invalid security certificate. It should use the one for mozilla.org, not mozilla.com. Does support.mozilla.org need to be under HTTPS? That runs off a site that just handles redirects, isn't really meant for SSL.

When Firefox connects to a secure website (the URL begins with 'https://'), it must verify that the certificate presented by the website is valid and that the encryption is strong enough to adequately protect your privacy. If it is unable to verify this, Firefox stops connecting to the site and will show you an error page with the message, Your connection is not secureWarning: Potential Security Risk Ahead.

Click the button to view the error code and other information about the error. Common errors are described in this article.

Note: If Firefox shows you a Secure Connection Failedor Did Not Connect: Potential Security Issue error page instead, see the article Secure connection failed and Firefox did not connect.

Table of Contents

  • 12Technical information

If you see a Warning: Potential Security Risk Ahead message, you may:

  • Contact the website owner and ask them to correct their certificate.
  • Click , or visit a different website.
  • If you are on a corporate network or using antivirus software, reach out to the support teams for assistance.

After viewing the error code and other information about the error, click the button to load the site at your own risk. This will add a security exception for the website certificate.

Warning! Do not proceed to the website unless you understand the reasons for the security warning. Legitimate public sites will not require you to add a security exception for their certificate. An invalid certificate can be an indication of a web page that will defraud you or steal your identity.

This error indicates that the website's certificate has not complied with security policies in Mozilla's CA Certificate Program. Most browsers, not just Firefox, do not trust certificates by GeoTrust, RapidSSL, Symantec, Thawte, and VeriSign because these certificate authorities failed to follow security practices in the past.

The owners of the website need to work with their certificate authority to correct the policy problem. Mozilla's CA Certificate Program publishes a list of upcoming policy actions affecting certificate authorities which contains details that might be useful to the website owners.

For more information, see the Mozilla Security Blog post, Distrust of Symantec TLS Certificates.

The certificate will not be valid until date (...)

Addons.mozilla.org Uses An Invalid Security Certificate

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem. More details about this are available in the support article How to troubleshoot time related errors on secure websites.

The certificate expired on date (...)
This error occurs when a website's identity certification has expired.

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem. More details about this are available in the support article How to troubleshoot time related errors on secure websites.

The certificate is not trusted because the issuer certificate is unknown.
The server might not be sending the appropriate intermediate certificates.
An additional root certificate may need to be imported.

The certificate is not trusted because the issuer certificate is unknown.
The server might not be sending the appropriate intermediate certificates.
An additional root certificate may need to be imported.

MOZILLA_PKIX_ERROR_MITM_DETECTED is a special case of the SEC_ERROR_UNKNOWN_ISSUER error code when a man-in-the-middle attack is detected.

You may have enabled SSL scanning in your security software such as Avast, Bitdefender, ESET or Kaspersky. Try to disable this option. More details are available in the support article How to troubleshoot security error codes on secure websites.

You may also see this error message on major sites like Google, Facebook, YouTube and others on Windows in user accounts protected by Microsoft family settings. To turn these settings off for a particular user, see the Microsoft support article How do I turn off family features?.

The certificate is not trusted because it is self-signed.

Self-signed certificates make your data safe from eavesdroppers, but say nothing about who the recipient of the data is. This is common for intranet websites that aren't available publicly and you may bypass the warning for such sites. More details are available in the support article How to troubleshoot security error codes on secure websites.

Firefox does not trust this site because it uses a certificate that is not valid for that particular site. Information sent over this site could be at risk, so the best thing for you to do is contact the website owners to correct the problem.

The site is not configured correctly and failed a security check. If you visit this site, attackers could try to steal your private information, like passwords, emails, or credit card details.

The issue is with the website, and there is nothing you can do to resolve it. You can notify the website’s administrator about the problem.

You may also see certificate error messages when the file in your profile folder that stores your certificates cert9.db has become corrupted. Try to delete this file while Firefox is closed to regenerate it:

Mozilla Invalid Security Certificate

Note: You should only perform these steps as a last resort, after all other troubleshooting steps have failed.

  1. Open your profile folder:

    • Click the menu button , click Help and select Troubleshooting Information.From the Help menu, select Troubleshooting Information. The Troubleshooting Information tab will open.
    • Under the Application Basics section next to Profile FolderDirectory, click . A window will open that contains your profile folder.Your profile folder will open.
    Note: If you are unable to open or use Firefox, follow the instructions in Finding your profile without opening Firefox.
  2. Click the Firefox menu and select Exit.Click the Firefox menu at the top of the screen and select Quit Firefox.Click the Firefox menu and select Quit.
  3. Click on the file named cert9.db.
  4. Press command+Delete.
  5. Restart Firefox.
Note:cert9.db will be recreated when you restart Firefox. This is normal.

If you encounter a 'Your connection is not secure' error, you should contact the owners of the website, if possible, and inform them of the error. It is recommended that you wait for the website to be fixed before using it. The safest thing to do is to click , or to visit a different website. Unless you know and understand the technical reason why the website presented incorrect identification, and are willing to risk communicating over a connection that could be vulnerable to an eavesdropper, you should not proceed to the website.

Click on for more information on why the connection is not secure. Some common errors are described below:

Certificate does not come from a trusted source

The certificate does not come from a trusted source.
Error code: MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED

This error indicates that Mozilla's CA Certificate Program has imposed policies upon this website's certificate authority that the website has not complied with. When this error occurs, it indicates that the owners of the website need to work with their certificate authority to correct the policy problem.

Mozilla's CA Certificate Program publishes a list of upcoming policy actions affecting certificate authorities which contains details that might be useful to the website owners.For more information, see the Mozilla Security Blog post, Distrust of Symantec TLS Certificates.

The certificate will not be valid until (date)

The certificate will not be valid until date (...)
Error code: SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem. More details about this are available in the support article How to troubleshoot time related errors on secure websites.

The certificate expired on (date)

Certificate
The certificate expired on date (...)
Error code: SEC_ERROR_EXPIRED_CERTIFICATE

This error occurs when a website's identity certification has expired.

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem. More details about this are available in the support article How to troubleshoot time related errors on secure websites.

The certificate is not trusted because the issuer certificate is unknown

The certificate is not trusted because the issuer certificate is unknown.
The server might not be sending the appropriate intermediate certificates.
An additional root certificate may need to be imported.
Error code: SEC_ERROR_UNKNOWN_ISSUER
The certificate is not trusted because the issuer certificate is unknown.
The server might not be sending the appropriate intermediate certificates.
An additional root certificate may need to be imported.
Error code: MOZILLA_PKIX_ERROR_MITM_DETECTED

MOZILLA_PKIX_ERROR_MITM_DETECTED is a special case of the SEC_ERROR_UNKNOWN_ISSUER error code when a man-in-the-middle attack is detected.

You may have enabled SSL scanning in your security software such as Avast, Bitdefender, ESET or Kaspersky. Try to disable this option. More details are available in the support article How to troubleshoot security error codes on secure websites.

You may also see this error message on major sites like Google, Facebook, YouTube and others on Windows in user accounts protected by Microsoft family settings. To turn these settings off for a particular user, see the Microsoft support article How do I turn off family features?.

Mozilla Invalid Security Certificate Status

The certificate is not trusted because it is self-signed

The certificate is not trusted because it is self-signed.
Error code: ERROR_SELF_SIGNED_CERT

Self-signed certificates make your data safe from eavesdroppers, but say nothing about who the recipient of the data is. This is common for intranet websites that aren't available publicly and you may bypass the warning for such sites. More details are available in the support article How to troubleshoot security error codes on secure websites.

The certificate is only valid for (site name)

example.com uses an invalid security certificate.
The certificate is only valid for the following names: www.example.com, *.example.com
Error code: SSL_ERROR_BAD_CERT_DOMAIN

This error is telling you that the identification sent to you by the site is actually for another site. While anything you send would be safe from eavesdroppers, the recipient may not be who you think it is.

A common situation is when the certificate is actually for a different part of the same site. For example, you may have visited https://example.com, but the certificate is for https://www.example.com. In this case, if you access https://www.example.com directly, you should not receive the warning.

Corrupted certificate store

You may also see certificate error messages when the file in your profile folder that stores your certificates (cert8.dbcert9.db) has become corrupted. Try to delete this file while Firefox is closed to regenerate it:

Note: You should only perform these steps as a last resort, after all other troubleshooting steps have failed.

  1. Open your profile folder:

    • Click the menu button , click Help and select Troubleshooting Information.From the Help menu, select Troubleshooting Information. The Troubleshooting Information tab will open.
    • Under the Application Basics section next to Profile FolderDirectory, click . A window will open that contains your profile folder.Your profile folder will open.
    Note: If you are unable to open or use Firefox, follow the instructions in Finding your profile without opening Firefox.
  2. Click the Firefox menu and select Exit.Click the Firefox menu at the top of the screen and select Quit Firefox.Click the Firefox menu and select Quit.
  3. Click on the file named cert8.dbcert9.db.
  4. Press command+Delete.
  5. Restart Firefox.

Mozilla Firefox Invalid Security Certificate Error

Note:cert8.dbcert9.db will be recreated when you restart Firefox. This is normal.

You should only bypass the warning if you're confident in both the identity of the website and the integrity of your connection - even if you trust the site, someone could be tampering with your connection. Data you enter into a site over a weakly encrypted connection can be vulnerable to eavesdroppers as well.

In order to bypass the warning page, click :

  • On sites with a weak encryption you will then be shown an option to load the site using outdated security.
  • On sites where the certificate cannot be validated, you might be given the option to add an exception.
Legitimate public sites will not ask you to add an exception for their certificate - in this case an invalid certificate can be an indication of a web page that will defraud you or steal your identity.