Note that the french sentence says something like "the certificate authority is not recognized" or something like that. But both certificate, authority and chain look legit:

$ openssl x509 -in mozilla.txt -text -noout Certificate:

   Data:
       Version: 3 (0x2)
       Serial Number:
           05:a0:2c:a3:b0:5a:1e:a9:8a:c8:06:80:fa:94:8f:58
   Signature Algorithm: sha256WithRSAEncryption
       Issuer: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
       Validity
           Not Before: Sep 20 00:00:00 2017 GMT
           Not After : Oct 31 12:00:00 2018 GMT
       Subject: C = US, ST = California, L = Mountain View, O = Mozilla Foundation, OU = WebOps, CN = support.mozilla.org
       Subject Public Key Info:
           Public Key Algorithm: rsaEncryption
               Public-Key: (2048 bit)
               Modulus:
                   00:d9:c2:70:c9:a7:f7:e9:74:61:32:d0:fb:e9:c0:
                   d0:b4:d5:e7:27:94:42:5e:ce:0a:6a:b7:d7:59:3d:
                   8b:68:ba:49:53:8f:63:c6:94:16:09:e4:8f:32:59:
                   42:d2:20:33:92:d1:ff:25:56:82:6b:47:a8:97:78:
                   85:fd:7e:82:3b:a1:c1:9a:d8:ae:85:cb:10:5e:1e:
                   dc:40:fb:20:a2:a8:59:7b:e6:c2:8e:5b:b4:d7:75:
                   3a:f9:36:62:20:46:4b:ae:18:77:b0:60:da:c9:78:
                   e9:57:fb:71:70:62:1c:b6:1a:4b:a7:90:9e:86:a3:
                   41:3f:49:4f:76:8a:72:0a:4c:6e:a2:49:8f:50:35:
                   6d:43:52:1e:88:48:b3:dd:2e:87:c2:5b:3d:bd:5c:
                   14:27:ed:fb:96:d9:0b:cf:8b:89:a5:96:2a:e8:33:
                   35:6d:e9:01:42:b5:b4:32:13:77:83:81:4f:94:ec:
                   2d:ef:0b:2f:c3:d4:9a:0c:bf:a5:2c:c0:84:1b:53:
                   f0:e8:2d:7c:da:ea:36:db:cb:59:de:3d:1a:05:01:
                   86:17:0e:18:31:0c:47:b2:70:48:e9:1a:47:c0:14:
                   72:57:49:85:2c:25:a7:b9:cc:51:26:12:af:ef:1e:
                   e4:bb:2b:7a:64:d5:27:6b:c3:73:a1:1c:b2:ab:a2:
                   c5:c7
               Exponent: 65537 (0x10001)
       X509v3 extensions:
           X509v3 Authority Key Identifier:
               keyid:0F:80:61:1C:82:31:61:D5:2F:28:E7:8D:46:38:B4:2C:E1:C6:D9:E2

           X509v3 Subject Key Identifier:
               A3:5C:00:F8:AB:09:AB:02:E7:04:78:4F:0A:55:CF:D7:10:1F:54:5E
           X509v3 Subject Alternative Name:
               DNS:support.mozilla.org, DNS:support.mozilla.com
           X509v3 Key Usage: critical
               Digital Signature, Key Encipherment
           X509v3 Extended Key Usage:
               TLS Web Server Authentication, TLS Web Client Authentication
           X509v3 CRL Distribution Points:

               Full Name:
                 URI:http://crl3.digicert.com/ssca-sha2-g1.crl

               Full Name:
                 URI:http://crl4.digicert.com/ssca-sha2-g1.crl

           X509v3 Certificate Policies:
               Policy: 2.16.840.1.114412.1.1
                 CPS: https://www.digicert.com/CPS
               Policy: 2.23.140.1.2.2

           Authority Information Access:
               OCSP - URI:http://ocsp.digicert.com
               CA Issuers - URI:http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt

           X509v3 Basic Constraints: critical
               CA:FALSE
   Signature Algorithm: sha256WithRSAEncryption
        db:6e:e5:93:82:9b:24:8b:6b:fe:8b:73:0e:b2:fd:64:50:fa:
        12:bf:5b:d1:38:0b:46:8a:ba:23:94:2c:0f:08:3d:c0:12:8e:
        8e:8e:56:79:1e:f9:8b:a4:e8:35:66:08:68:c0:ca:ff:aa:02:
        f0:88:c6:83:2f:de:10:0f:cb:cb:df:53:6f:a8:b1:46:ad:11:
        a5:93:85:b1:6c:26:0a:67:78:d0:e9:4c:c3:bb:f0:19:c4:9b:
        fa:d8:66:b8:5c:dd:32:a2:fb:05:d1:e3:0a:30:7c:29:30:1c:
        02:e7:43:91:a6:f5:a5:a9:d9:f4:2a:49:03:5f:32:df:91:68:
        07:9c:cc:22:2e:25:0e:a5:e0:76:9d:3a:95:75:bb:c1:81:08:
        da:29:49:57:01:f0:6f:6f:46:2c:e6:77:6a:ed:cf:55:f1:ef:
        ad:78:76:9c:2f:f9:12:36:ee:58:62:4d:99:07:f4:00:ad:58:
        82:4f:e9:09:e1:d9:d6:af:44:80:32:be:d4:34:9a:83:e0:d3:
        12:06:2f:f8:cd:27:e3:5d:20:3b:3a:a9:d4:b9:30:dc:b4:92:
        60:d7:ad:ab:cf:90:51:0e:0d:4b:4f:b8:9e:be:74:77:88:f9:
        3d:79:0d:f0:73:5d:06:5b:55:30:1f:06:46:a9:91:62:83:27:
        06:87:87:41

$ openssl x509 -in google.txt -text -noout Certificate:

   Data:
       Version: 3 (0x2)
       Serial Number: 6249375365626441844 (0x56ba3dc8d03db074)
   Signature Algorithm: sha256WithRSAEncryption
       Issuer: C = US, O = Google Trust Services, CN = Google Internet Authority G3
       Validity
           Not Before: Jun 19 11:40:36 2018 GMT
           Not After : Aug 28 11:32:00 2018 GMT
       Subject: C = US, ST = California, L = Mountain View, O = Google LLC, CN = mail.google.com
       Subject Public Key Info:
           Public Key Algorithm: id-ecPublicKey
               Public-Key: (256 bit)
               pub:
                   04:f4:5e:34:9c:1b:fb:65:88:e8:ca:ab:78:dd:05:
                   6b:f9:ea:95:53:36:23:d3:d8:d6:94:32:cd:93:f0:
                   62:95:76:b2:2d:da:a2:95:b9:55:3d:61:54:5d:29:
                   c4:89:c9:5d:82:c9:9e:ab:e2:1b:f0:ea:cc:2f:59:
                   39:63:ce:91:a6
               ASN1 OID: prime256v1
               NIST CURVE: P-256
       X509v3 extensions:
           X509v3 Extended Key Usage:
               TLS Web Server Authentication
           X509v3 Key Usage: critical
               Digital Signature
           X509v3 Subject Alternative Name:
               DNS:mail.google.com, DNS:inbox.google.com
           Authority Information Access:
               CA Issuers - URI:http://pki.goog/gsr2/GTSGIAG3.crt
               OCSP - URI:http://ocsp.pki.goog/GTSGIAG3

           X509v3 Subject Key Identifier:
               0B:7E:2B:A9:41:3E:61:21:61:B6:49:BE:28:13:6D:A1:E8:15:DC:9A
           X509v3 Basic Constraints: critical
               CA:FALSE
           X509v3 Authority Key Identifier:
               keyid:77:C2:B8:50:9A:67:76:76:B1:2D:C2:86:D0:83:A0:7E:A6:7E:BA:4B

           X509v3 Certificate Policies:
               Policy: 1.3.6.1.4.1.11129.2.5.3
               Policy: 2.23.140.1.2.2

           X509v3 CRL Distribution Points:

               Full Name:
                 URI:http://crl.pki.goog/GTSGIAG3.crl

   Signature Algorithm: sha256WithRSAEncryption
        7b:4f:7c:63:d1:bd:91:69:87:0a:08:6c:c5:64:ed:73:e1:9e:
        08:f4:33:15:fc:ed:3f:83:87:8c:93:c9:16:a2:67:83:88:7f:
        b8:7a:45:72:7d:99:bb:b5:1e:32:14:e1:ea:76:67:78:5f:24:
        5e:0d:0b:5d:83:82:90:b4:5d:a8:cf:59:c4:9e:bc:fd:9b:a5:
        b4:a3:fd:41:8c:e0:3b:58:96:14:80:9e:37:12:a4:63:30:56:
        54:6a:c1:89:92:48:31:3e:c3:7a:f3:ee:47:55:f8:64:fe:28:
        6b:d3:d1:d6:11:63:ae:98:ce:dd:f7:61:0c:e6:ba:8b:c7:1a:
        a5:8c:ae:5f:36:3d:68:0b:b2:78:5a:75:96:03:ba:e7:35:da:
        d1:8e:6c:74:60:45:06:b2:49:90:26:ed:c1:30:87:77:ab:f3:
        44:32:d4:b6:dc:ab:39:27:54:3b:ee:e0:08:ed:dd:19:26:9f:
        dc:07:55:fb:2a:7c:cc:44:0d:34:d5:43:0a:76:ea:a7:78:61:
        91:97:4a:ad:05:fd:25:0b:75:7f:09:67:2b:7c:de:06:c8:76:
        ab:df:a7:15:f4:c5:dd:de:e0:cb:e1:d4:16:be:b8:8f:cd:a0:
        52:77:29:b4:a6:42:4a:c7:b6:48:bb:7d:ec:ce:67:97:c9:f6:
        f9:e9:a4:e9

Try to rename the cert9.db (cert9.db.old) file and remove the previously used cert8.db file in the Firefox profile folder with Firefox closed to remove intermediate certificates and exceptions that Firefox has stored.

If that has helped to solve the problem then you can remove the renamed cert9.db.old file.

Firefox will store intermediate certificates that a server sends in the Certificate Manager for future use. Otherwise you can undo the rename.

You can use the button on the "Help -> Troubleshooting Information" (about:support) page to go to the current Firefox profile folder or use the about:profiles page.

• Help -> Troubleshooting Information -> Profile Directory:
  Windows: Show Folder; Linux: Open Directory; Mac: Show in Finder
• http://kb.mozillazine.org/Profile_folder_-_Firefox

Hi cor-el, how can I check that it fixes the issue since closing Firefox also fixes the issue ?

I also report there is no cert8.db there.

deleting cert9.db (there is no cert8.db) and restarting Firefox does not fix the issue, one day later the issue comes back.

Do the Windows computers have any special deployment modifications?

Is security.enterprise_roots.enabled modified (i.e is true) on the about:config page?

The security.enterprise_roots.enabled key is not modified and is set to false (default). We don't have enterprise root certificates. Our proxy does not decypher ssl connections.

These are the keys we deployed:

"app.update.auto", false "app.update.enabled", false "browser.cache.disk.capacity", 100000 "browser.search.update", true "browser.shell.checkDefaultBrowser", false "network.proxy.ftp", "proxy" "network.proxy.ftp_port", 3128 "network.proxy.http", "proxy" "network.proxy.http_port", 3128 "network.proxy.share_proxy_settings", true "network.proxy.socks", "proxy" "network.proxy.socks_port", 3128 "network.proxy.ssl", "proxy" "network.proxy.ssl_port", 3128 "network.proxy.type", 1 "privacy.donottrackheader.enabled", true "privacy.trackingprotection.pbmode.enabled", true "browser.disableResetPrompt", true

You can notice:

• a custom proxy but as said before, using the system proxy instead of the firefox one changes nothing and since the same version of firefox running on linux using the same proxy does not have the issue, it's probably not related to the proxy itself;
• disableResetPrompt is activated to prevent people losing their proxy configuration on unattended reset and by the way the profile I use to drive the tests was reseted recently;
• a custom value for the user cache but in fact firefox increases it itself and modifying it changes nothing;
• the autoupdate is disabled because we have an internal process to deploy software;
• we deploy no other keys.

An useful information about our specific setup is that %AppData% (the user profile itself) is stored on a network drive when %LocalAppData% (cache things) is on a physical drive local to the machine running firefox.

Is anything scheduled to happen around that time in the Windows Task Scheduler?

we haven't added any custom scheduled tasks by hand at all and I haven't seen any system one at that time

Any other idea? What can I do to troubleshoot this issue?