SEC_ERROR_UNKNOWN_ISSUER error appears when Firefox uses enterprise proxy and DNS-over-HTTPS
Goal Determine whether Firefox should treat DNS-over-HTTPS canary and enterprise policy signals as authoritative per‑network or per‑profile in split‑DNS or captive‑portal environments. Constraints and uncertainty Firefox currently applies these signals per‑profile, which can cause intermittent NXDOMAIN failures for internal‑only domains when the same profile