"This Connection is Untrusted" error message appears - What to do

This article is no longer maintained, so its content might be out of date.

This article applies to older versions of Firefox (versions 43 and below).

This article describes why the This Connection Is Untrusted error message may appear when trying to visit secure (https) websites in Firefox.

Note: If you see this error message on major sites like Google, Facebook, YouTube and others in user accounts protected by Microsoft Family Safety filter, please refer to Microsoft's documentation for Windows Update KB2965142 (published on 6/9/2014) and Windows Update KB2981655 (published on 8/11/2014).
Note: You may currently see this error message on major sites like Google, Facebook, YouTube and others on Windows 10 in user accounts protected by Microsoft family settings. To turn these settings off for a particular user, see the Microsoft support article, Turn off Microsoft family settings.

Certificates and identification

When you visit a website whose web address starts with https, your communication with the site is encrypted to help ensure your privacy. Before starting the encrypted communication, the website will present Firefox with a "certificate" to identify itself.

The certificate helps Firefox determine whether the site you're visiting is actually the site that it claims to be. If there is a problem with the certificate, you will see the This Connection Is Untrusted alert page.

Connection Untrusted

Seeing the alert does not necessarily mean that the website you're visiting is trying to trick you into believing it is a different website - it means that Firefox isn't able to verify the identity of the website, and that you should proceed carefully.

There are several problems that can cause Firefox to reject a certificate. Some of them are described in detail in the Technical information section below.

Get out of there!

The safest thing to do is to click Get me out of here!, or to go to a different website. Unless you know and understand the technical reason why the website presented incorrect identification, and are willing to risk communicating over a connection that could be vulnerable to an eavesdropper, you should not proceed to the website.

If possible, you should contact the owners of the website and inform them of the error.

Technical information

Click on Technical Details for more information on why the website's identity information is invalid. Some common errors are described below.

The certificate will not be valid until (date)

The certificate will not be valid until date (...)

Error code: SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem.

The certificate expired on (date)

The certificate expired on date (...)

Error code: SEC_ERROR_EXPIRED_CERTIFICATE

This error occurs when a website's identity certification has expired.

The error text will also show the current date and time of your system. In case this is incorrect, set your system clock to today's date and time (double-click the clock icon on the Windows Taskbar) in order to fix the problem.

The certificate is not trusted because the issuer certificate is unknown

The certificate is not trusted because the issuer certificate is unknown.
The server might not be sending the appropriate intermediate certificates.
An additional root certificate may need to be imported.

Error code: SEC_ERROR_UNKNOWN_ISSUER

You may have enabled SSL scanning in your security software such as Avast, Bitdefender, ESET or Kaspersky. Try to disable this option. More details about this are available in the support article How to troubleshoot security error codes on secure websites.

You may also see this error message on major sites like Google, Facebook, YouTube and others on Windows in user accounts protected by Microsoft family settings. To turn these settings off for a particular user, see the Microsoft support article How do I turn off family features?.

The certificate is not trusted because it is self-signed

The certificate is not trusted because it is self-signed.

Error code: SEC_ERROR_UNKNOWN_ISSUER

Self-signed certificates make your data safe from eavesdroppers, but say nothing about who the recipient of the data is. This is common for intranet websites that aren't available publicly and you may bypass the warning for such sites.

The certificate is only valid for (site name)

example.com uses an invalid security certificate.

The certificate is only valid for the following names: www.example.com, *.example.com

Error code: SSL_ERROR_BAD_CERT_DOMAIN

This error is telling you that the identification sent to you by the site is actually for another site. While anything you send would be safe from eavesdroppers, the recipient may not be who you think it is.

A common situation is when the certificate is actually for a different part of the same site. For example, you may have visited https://example.com, but the certificate is for https://www.example.com. In this case, if you access https://www.example.com directly, you should not receive the warning.

Corrupted certificate store

You may also see certificate error messages when the file in your profile folder that stores your certificates (cert8.db) has become corrupted. Try to delete this file while Firefox is closed to regenerate it:

Note: You should only perform these steps as a last resort, after all other troubleshooting steps have failed.
  1. Open your profile folder:

    • Click the menu button Fx89menuButton, click Help and select More Troubleshooting Information.From the Help menu, select More Troubleshooting Information. The Troubleshooting Information tab will open.
    • Under the Application Basics section next to Profile FolderProfile Directory, click Open FolderShow in FinderOpen Directory. A window will open that contains your profile folder.Your profile folder will open.Your profile folder will open.
    Note: If you are unable to open or use Firefox, follow the instructions in Finding your profile without opening Firefox.

  2. Click the Firefox menu Fx89menuButton and select Exit.Click the Firefox menu at the top of the screen and select Quit Firefox.Click the Firefox menu Fx89menuButton and select Quit.
  3. Click on the file named cert8.db.
  4. Press command+Delete.
  5. Restart Firefox.
Note:cert8.db will be recreated when you restart Firefox. This is normal.

Bypassing the warning

You should only bypass the warning if you're confident in both the identity of the website and the integrity of your connection - even if you trust the site, someone could be tampering with your connection. Legitimate public sites will not ask you to add connection rule exceptions - an invalid certificate can be an indication of a web page that will defraud you or steal your identity.

  1. On the warning page, click I Understand the Risks.
  2. Click Add Exception.... The Add Security Exception dialog will appear.
  3. Read the text describing the problems with this site.
  4. Click Confirm Security Exception if you want to trust the site.
If I Understand the Risks is missing, this page may be opened in an (i)frame. In that case, press Ctrl and click onright-click the frame, choose This Frame, then Open Frame in New Tab, and continue as above.

These fine people helped write this article:

Illustration of hands

Volunteer

Grow and share your expertise with others. Answer questions and improve our knowledge base.

Learn More