Skip to main content

Why Does Firefox Show the Error "Firefox Can’t Establish a Secure Connection" When Opening a Simulation Landing Page?

  • Updated

This article addresses the most common questions about the error "Firefox can’t establish a secure connection" that appears when accessing the trap link of a Phishing or Ransomware simulation. The error originates from the corporate SSL inspection in the client’s environment and is resolved by importing the corporate CA root certificate into Firefox.

What Causes the Error?

Firefox does not trust the SSL certificate it receives when opening the simulation landing page domain.

This happens when the organization has an active corporate SSL inspection: a proxy or firewall intercepts HTTPS traffic and presents its own certificate instead of the original. Unlike Chrome and Edge, Firefox does not use the Windows certificate store but its own store, so it does not recognize the proxy’s certificate as valid and blocks the connection.

The error occurs in Firefox when validating the certificate it receives. It is not generated by SMARTFENSE nor does it affect the landing page’s functionality.

Is This a SMARTFENSE Problem?

No. The cause and solution lie entirely within the client’s environment:

  • The certificate to import is the client’s corporate CA certificate, not SMARTFENSE’s.
  • The import is performed in Firefox, software installed on the user’s machine.
  • Policy configuration is the responsibility of the client’s IT administrator.

The only relation to SMARTFENSE is that the simulation landing page domain is what Firefox tries to open when the user clicks the trap link.

How Is It Fixed?

By importing the corporate CA root certificate into Firefox’s certificate store, or configuring Firefox to use the operating system’s certificate store.

Step 1 — Obtain the Corporate Root Certificate

The IT administrator must export the root CA certificate that signs the proxy or firewall certificates, in .CRT, .PEM, or .CER format. There are three ways to obtain it.

Option A — From Windows Certificate Manager

  1. Press Windows + R, type certmgr.msc, and press Enter.
  2. In the left panel, go to Trusted Root Certification Authorities > Certificates.
  3. Locate the corporate root certificate. It usually bears the company’s or device manufacturer’s name, for example "CompanyName-CA," "Fortinet CA," or "WatchGuard CA."
  4. Right-click the certificate and select All Tasks > Export.
  5. In the wizard, choose the format X.509 Base-64 encoded (.CER) or DER encoded binary (.CER).
  6. Save the file.

Option B — From Chrome or Edge

Chrome and Edge do trust the certificate, so it can be exported from there. This is the quickest option if you’re not experienced with certificates.

  1. Open Chrome or Edge and navigate to any HTTPS page of the organization, for example the intranet.
  2. Click the padlock in the address bar, then click Connection is secure > Certificate is valid.
  3. In the certificate window, open the Certification Path tab.
  4. Select the root certificate at the top of the chain.
  5. Click View Certificate > Details > Copy to File.
  6. In the wizard, choose the format X.509 Base-64 encoded (.CER).
  7. Save the file.

Option C — From the Firewall or Proxy Console

If the certificate is generated by the device itself (WatchGuard, Fortinet, Palo Alto, or others), the administrator can export it from its management console. The exact location varies by manufacturer but is generally found under System > Certificates > Root CA > Export.

Step 2 — Import the Certificate into Firefox

Perform this procedure on each affected machine.

  1. Open Firefox.
  2. Go to Settings (☰) > Privacy & Security.
  3. Scroll down to the Certificates section and click View Certificates.
  4. In the Authorities tab, click Import.
  5. Select the corporate root certificate file obtained in Step 1.
  6. Check the option Trust this CA to identify websites.
  7. Click OK.

Is There a Way to Fix This for All Users at Once?

Yes. If the organization manages Firefox via GPO or enterprise policies, you can force Firefox to use the Windows certificate store instead of its own. This resolves the issue for all users without needing to import the certificate on each machine.

In the Firefox policy (policies.json or GPO with Firefox ADMX templates), add:

 
json
{
  "policies": {
    "Certificates": {
      "ImportEnterpriseRoots": true
    }
  }
}

With this configuration, Firefox automatically accepts all trusted certificates from the operating system, including the corporate proxy’s certificate.

This is the recommended alternative in environments with many machines, as it avoids manual import and remains effective after proxy certificate renewals.

Does It Affect Simulation Results?

Yes. If Firefox blocks the connection, the user never reaches the landing page and the interaction is not recorded properly. Therefore, it’s advisable to validate access to the trap link from the browsers used in the organization before launching the campaign.

💡 Best Practices

  • Verify access to the trap link from all browsers used in the organization before launching a campaign.
  • Apply the ImportEnterpriseRoots policy when multiple machines use Firefox, instead of importing the certificate manually on each one.
  • Coordinate with the IT team to exclude simulation URLs from filtering and SSL inspection tools.
  • Document in the client’s internal inventory which corporate CA is installed and in which browsers.
  • Review the configuration after each renewal of the corporate proxy or firewall certificate.

Related articles