SEC_ERROR_UNKNOWN_ISSUER error appears when Firefox uses enterprise proxy and DNS-over-HTTPS

The SEC_ERROR_UNKNOWN_ISSUER error in Firefox when using DNS-over-HTTPS (DoH) typically occurs because an enterprise proxy is intercepting the TLS connection to the DoH resolver. Since DoH uses HTTPS (port 443), the proxy performs TLS inspection by presenting its own certificate. If Firefox does not trust the internal Certificate Authority (CA) that signed that proxy certificate, the connection fails.

The Root Cause Conflict

The issue is exacerbated in roaming environments because Firefox currently manages DoH settings on a per-profile basis. When a user roams from a network where DoH is allowed to a corporate network where a mandatory MITM proxy is active, Firefox continues to attempt use of the DoH resolver. This leads to two specific failure modes:

• Certificate Validation Failure: The proxy intercepts the DoH request, providing an untrusted certificate.
• NXDOMAIN Failures: Internal-only domains fail to resolve because the public DoH resolver cannot see the internal split-horizon DNS records.

Resolution Steps

To resolve this while maintaining enterprise security, you must ensure Firefox trusts the interceptor or bypasses it where necessary.

1. Import the Enterprise CA: Firefox does not always use the OS certificate store (especially on Linux). You must explicitly import the proxy's CA. Use policies.json to automate this across the organization:

   {
     "Certificates": {
       "ImportEnterpriseRoots": true
     }
   }
       

2. Configure TRR Mode: If the proxy breaks DoH, consider setting network.trr.mode to 2 (Default). This allows Firefox to use system DNS if DoH fails, preventing total loss of connectivity on restricted corporate networks.
3. Exclude Internal Domains: To prevent NXDOMAIN errors in split-DNS environments, use the network.trr.excluded-domains preference to list internal suffixes (e.g., .internal, .company.com).

Technical Assumptions and Uncertainty

This analysis assumes the proxy is performing active TLS inspection. If the proxy is simply blocking port 443, the error would likely be a SEC_CONNECTION_REFUSED instead. There is uncertainty regarding Firefox's native ability to dynamically re-evaluate DoH per SSID; currently, the "canary" check is performed at startup and cached, which may lead to the intermittent flapping behavior observed during rapid network transitions.