On websites which are supposed to be secure (the URL begins with "http s: // "), Firefox must verify that the certificate presented by the website is valid. If the certificate cannot be validated, Firefox will stop the connection to the website and show a" Warning: Potential Security Risk Ahead "error page instead.
This article explains why you might see SEC_ERROR_UNKNOWN_ISSUER, MOZILLA_PKIX_ERROR_MITM_DETECTED or ERROR_SELF_SIGNED_CERT error codes on an error page and how to troubleshoot it.
- For other error codes on the "Warning: Potential Security Risk Ahead" error page, see the What do the security warning codes mean? article.
Table of Contents
What does this error code mean?
During a secure connection, a website must provide a certificate issued by a trusted certificate authority to ensure that the user is connected to the intended target and the connection is encrypted. If you click the Advanced button on a "Warning: Potential Security Risk Ahead" error page and you see the error code SEC_ERROR_UNKNOWN_ISSUER or MOZILLA_PKIX_ERROR_MITM_DETECTED, it means that the provided certificate was issued by a certificate authority that is not known by Firefox and therefore cannot be trusted by default.
The error occurs on multiple secure sites
In case you get this problem on multiple unrelated HTTPS-sites, it indicates that something on your system or network is intercepting your connection and injecting certificates in a way that is not trusted by Firefox. The most common causes are security software scanning encrypted connections or malware listening in, replacing legitimate website certificates with their own. In particular, the error code MOZILLA_PKIX_ERROR_MITM_DETECTED indicates that Firefox is able to detect that the connection is intercepted.
Antivirus products
Third-party antivirus software can interfere with Firefox "s secure connections. You could try reinstalling it, which might trigger the software into placing its certificates into the Firefox trust store again.
We recommend uninstalling your third-party software and using the security software offered for Windows by Microsoft:
- Windows 8 and Windows 10 - Windows Defender (built-in)
If you do not want to uninstall your third-party software, you could try reinstalling it, which might trigger the software into placing its certificates into the Firefox trust store again.
Here are some alternative solutions you can try:
Avast / AVG
In Avast or AVG security products you can disable the interception of secure connections:
- Open the dashboard of your Avast or AVG application.
- Go to Menu and click on Settings> Protection> Core Shields.
- Scroll down to the Configure shield settings section and click on Web Shield.
- Uncheck the box next to Enable HTTPS Scanning and confirm this by clicking OK.
In older versions of the product you "ll find the corresponding option when you go to Menu> Settings> Components and click Customize next to Web Shield
Bitdefender
In Bitdefender security products you can disable the interception of secure connections:
- Open the dashboard of your Bitdefender application.
- Go to Protection and in the Online Threat Prevention section click on Settings.
- Toggle off the Encrypted Web Scan setting.
In older versions of the product you can find the corresponding option labeled Scan SSL when you go to Modules> Web Protection
In Bitdefender Antivirus Free it "s not possible to control this setting. You can try to repair or remove the program instead when you" re having problems accessing secure websites.
For corporate Bitdefender products, please refer to this Bitdefender Support Center page.
Bullguard
In Bullguard security products you can disable the interception of secure connections on particular major websites like Google, Yahoo and Facebook:
- Open the dashboard of your Bullguard application.
- Click on Settings and enable the Advanced view on the top right of the panel.
- Go to Antivirus> Safe browsing.
- Uncheck the Show safe results option for those websites which are showing an error message.
ESET
In ESET security products you can try to disable and re-enable SSL / TLS protocol filtering or generally disable the interception of secure connections as described in ESET’s support article.
Kaspersky
Affected users of Kaspersky should upgrade to the most recent version of their security product, as Kaspersky 2019 and above contain mitigations for this problem. The Kaspersky Downloads page includes "update" links that will install the latest version free of charge for users with a current subscription.
Otherwise, you can also disable the interception of secure connections:
- Open the dashboard of your Kaspersky application.
- Click on Settings on the bottom-left.
- Click Additional and then Network.
- In the Encrypted connections scanning section check the Do not scan encrypted connections option and confirm this change.
- Finally, reboot your system for the changes to take effect.
Family Safety settings in Windows accounts
In Microsoft Windows accounts protected by Family Safety settings, secure connections on popular websites like Google, Facebook and YouTube might be intercepted and their certificates replaced by a certificate issued by Microsoft in order to filter and record search activity.
Monitoring / filtering in corporate networks
Some traffic monitoring / filtering products used in corporate environments might intercept encrypted connections by replacing a website "s certificate with their own, at the same time possibly triggering errors on secure HTTPS-sites.
If you suspect this might be the case, please contact your IT department to ensure the correct configuration of Firefox to enable it working properly in such an environment, as the necessary certificate might have to be placed in the Firefox trust store first. More information for IT departments on how to go about this can be found in the Mozilla Wiki page CA: AddRootToFirefox.
Malware
Some forms of malware intercepting encrypted web traffic can cause this error message - refer to the article Troubleshoot Firefox issues caused by malware on how to deal with malware problems.
The error occurs on one particular site only
In case you get this problem on one particular site only, this type of error generally indicates that the web server is not configured properly. However, if you see this error on a legitimate major website like Google or Facebook or sites where financial transactions take place, you should continue with the.
Certificate issued by a authority belonging to Symantec
After a number of irregularities with certificates issued by Symantec root authorities came to light, browser vendors including Mozilla are gradually removing trust from these certificates in their products. Firefox will no longer trust server certificates issued by Symantec, including those issued under the GeoTrust, RapidSSL, Thawte and Verisign brands. For more information, see this Mozilla blog post and this compatibility document.
MOZILLA_PKIX_ERROR_ADDITIONAL_POLICY_CONSTRAINT_FAILED will be the primary error but with some servers, you may see the error code SEC_ERROR_UNKNOWN_ISSUER instead. In any case, if you come across such a site you should contact the owner of the website to inform them of the problem.
Mozilla strongly encourages operators of affected sites to take immediate action to replace these certificates. DigiCert is providing
If, when trying to establish a secure connection with any site using the https: // protocol (for example, https://webmoney.ru) in the browser window Mozilla Firefox You see the following picture, and installed Anti-Virus Kaspersky () reports that “It is impossible to guarantee the authenticity of the domain with which the encrypted connection is being established. This certificate or chain of certificates is built on an untrusted root center ", then you need to install the Moxilla Firefox browser root certificate of Kaspersky Anti-Virus Personal Root Certificate.
To do this, find the certificate on the computer along the path * C: \ ProgramData \ Kaspersky Lab \ AVP18.0.0 \ Data \ Cert \ (fake) Kaspersky Anti-Virus Personal Root Certificate.ce r, and then in the Mozilla Firefox menu (top right - three horizontal lines) click "Settings - Advanced - View Certificates - Certification Authorities". Then click “Import”, in the window that opens, select the file “C: \ ProgramData \ Kaspersky Lab \ AVP18.0.0 \ Data \ Cert \ (fake) Kaspersky Anti-Virus Personal Root Certificate.cer). Install it by checking the "Trust when checking sites" checkbox.
* Note! The path may differ depending on the version of your Kaspersky Lab anti-virus installed.
If the path is different, it is better to install the latest version of the antivirus. It is highly likely that after this the problem will disappear by itself, and all subsequent actions will not need to be performed.
Download links latest versions Kaspersky Lab products:
** If you cannot get to the certificate through the explorer, turn on the display of hidden files and folders according to the instructions from articles.
To control the correctness of the operations performed in the window View certificates open the tab Certification Authorities and find the root certificate you installed, open the certificate information window by clicking the button "View"... Make sure the certificate is valid.
U K O W O D S T V O P O L Z O V A T E L Z
THIS SECTION
CHECKING SECURED CONNECTIONS IN
The Mozilla Firefox browser does not use the Microsoft Windows certificate store. To check SSL connections
when using Firefox, you must install the Kaspersky Lab certificate manually.
You can also use the Certificate Installation Wizard if your browser is not running.
To manually install a Kaspersky Lab certificate, do the following:
Instruments Customization.
Additionally.
3. In the block Certificates select a bookmark Safety and click on the button View
certificates.
Certification Authorities and click on the button Restore.
certificate
"Laboratories
Kaspersky ":
.
View.
To manually install the Kaspersky Lab certificate for Mozilla Firefox version 3.x,
follow these steps:
1. In the browser menu, select Instruments Customization.
2. In the window that opens, select the section Additionally.
3. On the tab Encryption click on the button View certificates.
4. In the window that opens, select the bookmark Certification Authorities and click on the button Import.
5. In the window that opens, select the Kaspersky Lab certificate file. The path to the file
certificate
"Laboratories
Kaspersky ":
% AllUsersProfile% \ Application Data \ Kaspersky Lab \ AVP11 \ Data \ Cert \ (fake) Kaspersky Anti-
Virus personal root certificate.cer.
6. In the window that will open, check the boxes to select the actions to check which will be
the installed certificate is applied. To view information about the certificate, click the button
View.
If your computer is running an operating room Microsoft systems Windows Vista or Microsoft
Windows
certificate
"Laboratories
Kaspersky "
as follows:
% AllUsersProfile% \ Kaspersky Lab \ AVP11 \ Data \ Cert \ (fake) Kaspersky Anti-Virus personal root certificate.cer.
Checking secure connections in Mozilla Firefox
The Mozilla Firefox browser does not use the Microsoft Windows certificate store. To check SSL connections when using Firefox, you must install the Kaspersky Lab certificate manually.
To install a Kaspersky Lab certificate, do the following:
- In the Certificates section, select the Security tab and click the button View certificates.
- Certification Authorities and click on the Restore button.
- .
To install the Kaspersky Lab certificate for Mozilla Firefox version 3.x, do the following:
- In the browser menu, select Tools ® Options.
- In the window that opens, select the Additional section.
- On the Encryption tab, click the button View certificates.
- In the window that opens, select the bookmark Certification Authorities and click the Import button.
- In the window that opens, select the Kaspersky Lab certificate file. Path to the Kaspersky Lab certificate file: % AllUsersProfile% \ Application Data \ Kaspersky Lab \ AVP60MP4 \ Data \ Cert \ (fake) Kaspersky Anti-Virus personal root certificate.cer.
- In the window that opens, check the boxes to select actions to check for which the installed certificate will be used. Use the View button to view information about the certificate.
If your computer is running Microsoft Windows Vista, the path to the Kaspersky Lab certificate file will be as follows: % AllUsersProfile% \ Kaspersky Lab \ AVP60MP4 \ Data \ Cert \ (fake) Kaspersky Anti-Virus personal root certificate.cer.
When I installed on a freshly purchased laptop with operating system Windows 8.1 x64 Kaspersky Anti-Virus, or rather Kaspersky Internet Security for all devices (Version 2016 (16.0.0.614)), then at the very first attempt to enter the Yandex site (also true for Google) I received the following warning in the window FireFox browser x64 v43.0.0:
At the same time, most other sites working on the HTTPS protocol, including my blog, opened quite normally. That is, there were no failures in the operation of the browser.
How Kaspersky checks secure SSL connections
Kaspersky Anti-Virus scans secure SSL connections by installing a Kaspersky Lab certificate (self-signed certificate). And the absence of such a certificate in the browser storage leads to the described error. Automatic installation certificate is triggered for the baruser Internet Explorer... And for Mozilla Firefox, in order to fix the above error, you need to manually register the certificate in the browser settings.
How to add a Kaspersky certificate to FireFox
To add a certificate from Kaspersky, follow these steps:
Go to browser settings
In the "Additional" section of the "Certificates" menu, click the [View Certificates]
In the "Certification Authorities" tab, click the [Import ...]
Select a certificate (fake) Kaspersky Anti-Virus personal root certificate.cer... Which Kaspersky 16.0.0.614 in Windows 8.1 is located at C: \ ProgramData \ Kaspersky Lab \ AVP16.0.0 \ DataCert and click the [Open] button
If you do not see the folder in your browser ProgramData then read how to fix it.
In the window that appears, check the required options (I selected all). And click [OK]
Now in the list of repositories FireFox certificates you should see a Kaspersky Lab certificate, which the browser will consider trusted.
After carrying out all the above actions, the Yandex and Google sites began to open normally.
How to enable viewing of hidden folders in Windows Explorer
Go to the control panel and select the "Folder options"
In the "View" tab, check at the very bottom the item "Show hidden files, folders and drives"
Alternative solution to unblock HTTPS protocol in Kaspersky
This option is to disable the scan of protected connections by Kaspersky. To do this, go to the antivirus settings:
In the "Advanced" menu item, select the "network" section:
And in it, disable the scan of encrypted connections:
In this case, the antivirus will give you a warning that the level of computer protection in this case will be lower.