TL;DR — Quick Summary

IDSE IMSS browser compatibility fix: resolve Java applet errors, unrecognized e.firma certificate, and SSL failures using Edge IE Mode and Java JRE 8.

If you are an employer or work in HR at a Mexican company, you know that the IDSE (IMSS Desde Su Empresa) portal is essential for filing employee enrollment changes — registrations, terminations, and salary modifications with IMSS. The problem is that this portal is notorious for browser compatibility errors. Messages like “Error loading applet”, “Certificate not recognized”, or simply a blank screen when trying to access it are far more common than they should be. This article explains what causes these errors and how to resolve them step by step.

The Error

Browser compatibility errors in the IDSE IMSS portal appear in several ways depending on the browser and machine configuration. The most common ones are:

  • Blank screen or page that won’t load — When navigating to https://idse.imss.gob.mx in Chrome, Firefox, or modern Edge, the portal shows no content or loads indefinitely.
  • “Error loading applet” — The Java component needed for signing and authentication fails to initialize. A gray box or error message appears inside the page.
  • “Java plugin not installed” or “Plugin blocked” — The browser detects that Java is missing or blocks it as insecure.
  • “SSL certificate error” or “ERR_SSL_VERSION_OR_CIPHER_MISMATCH” — The browser cannot negotiate a TLS protocol compatible with the IDSE server.
  • “e.firma not recognized” or “Error loading certificate” — The portal cannot read the .cer or .key files of the electronic signature.
  • Portal freezes when submitting enrollment movements — The form loads but fails at the signing and submission stage.

These errors affect virtually all users running Chrome 45+, Firefox 52+, or Edge in normal mode — in other words, any browser updated since 2015.

Root Cause

The core issue is that the IDSE portal was built at a time when Internet Explorer and Java applets were the standard for government web applications. Since then, the browser ecosystem has evolved dramatically and removed these technologies for security reasons:

Java applet (NPAPI) dependency: IDSE uses Java applets to handle electronic signing and certificate-based authentication. Chrome dropped support for the NPAPI plugin (which Java requires) in 2015, and Firefox did so in 2017. Without this plugin, applets simply do not execute.

Outdated TLS protocols: The IDSE server may require TLS 1.0 or TLS 1.1 to establish connections. Modern browsers disable these protocols by default since 2020 because they have known vulnerabilities (POODLE, BEAST). The result is an SSL handshake error that prevents the portal from loading.

IMSS intermediate certificates: The SSL certificate for imss.gob.mx may not include the full intermediate certificate chain, causing modern browsers to reject the connection because they cannot verify the trust chain.

ActiveX control incompatibility: Some IDSE functions depend on ActiveX controls, a technology exclusive to Internet Explorer that no other browser has implemented.

BrowserIDSE CompatibilityNotes
Internet Explorer 11FullDiscontinued by Microsoft since 2022
Edge (IE mode)HighBest currently available option
Firefox ESRMediumRequires manual Java configuration
ChromeVery lowNo Java support since 2015
Edge (normal mode)Very lowBlocks Java and old TLS
Firefox (current)Very lowNo NPAPI/Java support

Step-by-Step Solution

Step 1: Configure Microsoft Edge in Internet Explorer mode

This is the official and most reliable solution. Edge includes an Internet Explorer compatibility engine that allows legacy sites like IDSE to run:

  1. Open Microsoft Edge and navigate to edge://settings/defaultBrowser.
  2. Under “Allow sites to be reloaded in Internet Explorer mode”, select “Allow”.
  3. Scroll to the “Internet Explorer mode pages” section and click “Add”.
  4. Add the following URLs:
    • https://idse.imss.gob.mx
    • https://certificados.imss.gob.mx
  5. Click Add to confirm and close the settings.
  6. Fully restart Edge (close all windows).
  7. Navigate to https://idse.imss.gob.mx — you will see an Internet Explorer icon in the address bar when IE mode is active.

Important: Edge IE mode is only available on Windows 10 and Windows 11. If you are using an older Windows version, you will need Internet Explorer 11 directly or a virtual machine.

Step 2: Install Java JRE 8

The IDSE portal requires Java to run its signing applets. You must install specifically version 8 — not newer versions:

  1. Download Java JRE 8 from https://www.java.com/en/download/.
  2. Run the installer and follow the instructions. Accept the default options.
  3. If the system asks you to restart, do so before continuing.
  4. To verify the installation, open the Start menu and search for “Configure Java” — the Java Control Panel should appear.

Note: If you already have Java 11, 17, or a newer version installed, the IDSE applet may still not work. Java 9 and above removed browser applet support. Keep Java JRE 8 exclusively for IDSE use.

Step 3: Add IDSE as a Java security exception

By default, Java blocks applet execution on sites that are not on the exceptions list. You must add IDSE manually:

  1. Open the Java Control Panel (search for “Configure Java” in the Start menu).
  2. Go to the “Security” tab.
  3. Verify that “Enable Java content in the browser” is checked.
  4. Set the security level to “High” (do not use “Very High” as it would block IDSE).
  5. Click “Edit Site List” and then “Add”.
  6. Type https://idse.imss.gob.mx and click OK.
  7. Close the Java Control Panel saving all changes.

Step 4: Enable TLS 1.0 and TLS 1.1 in Internet Options

If you receive SSL errors or the portal fails to load due to secure connection issues:

  1. Open Internet Options (find it in the Windows Control Panel).
  2. Go to the “Advanced” tab.
  3. In the “Security” section, locate and check:
    • ☑ Use TLS 1.0
    • ☑ Use TLS 1.1
    • ☑ Use TLS 1.2
  4. Click “Apply” and then “OK”.
  5. Close and reopen Edge.

Security warning: TLS 1.0 and 1.1 have known vulnerabilities. Disable them again after finishing your IDSE tasks to keep your computer secure.

Step 5: Load the e.firma certificate in the IDSE portal

Once the portal loads correctly with Edge in IE mode:

  1. On the IDSE home page, select “Access with e.firma”.
  2. Click the button to select your certificate file (.cer).
  3. Browse to where you saved your e.firma and select the .cer file.
  4. Click to select your private key file (.key).
  5. Select the corresponding .key file.
  6. Enter your private key password (the one you set when obtaining your e.firma at SAT). It is case-sensitive.
  7. Click “Submit” or “Enter”.

If the portal does not show the file selection buttons or a gray box appears, Java is not loading. Go back to Steps 2 and 3.

Step 6: Clear cache if errors persist

If after all the above steps the portal still fails:

  1. In Edge, press Ctrl + Shift + Delete. Select “All time” as the range and check all boxes. Click “Clear now”.
  2. Open the Java Control Panel > General > Temporary Internet Files > Settings > Delete Files. Check all options and confirm.
  3. Close all browser windows.
  4. Restart Edge and navigate to IDSE again in IE mode.

Alternative Solution

If Edge IE mode is not available on your Windows version, or if IDSE still fails after configuration, consider these alternatives:

Firefox ESR (Extended Support Release): Older Firefox ESR versions still allow enabling Java in some environments.

  1. Download Firefox ESR from https://www.mozilla.org/en-US/firefox/enterprise/.
  2. Install Firefox ESR and Java JRE 8.
  3. In Firefox, go to about:config in the address bar.
  4. Accept the warning and search for security.tls.version.min. Change the value to 1.
  5. Access IDSE from Firefox ESR.

Virtual machine with Windows 7 and IE 11: If Edge IE mode does not work, you can create a virtual machine running Windows 7 where Internet Explorer 11 and Java JRE 8 are fully compatible with IDSE. This is the most complex option but also the most reliable in extreme cases.

In-person filing: As a last resort, IMSS subdelegations have service windows where you can file enrollment movements in person if you cannot access the portal.

Prevention

To avoid these problems in the future:

  • Maintain a dedicated Edge profile for IDSE: Create a separate Edge profile specifically for IMSS and SAT tasks. Configure IE mode and Java only in that profile without using it for general browsing.
  • Do not update Java if IDSE works: If you found a Java JRE 8 version that works, do not update it automatically. Java updates can change security settings that break compatibility.
  • Document the configuration that works: Note down the exact steps that worked — Java version number, Edge configuration, etc. If you change computers or reinstall Windows, you will have the exact reference.
  • Renew your e.firma before it expires: The e.firma is valid for 4 years. You can renew it online up to 1 year before expiration. If it has already expired, you must go to SAT in person.
  • Check IDSE status before troubleshooting your machine: The portal has scheduled maintenance windows. If you cannot access it, check the official IMSS social media accounts before spending hours reconfiguring your computer.
  • Store your e.firma files securely: Keep copies of your .cer and .key files in at least two locations (encrypted USB drive and cloud backup). If they are lost or corrupted, you will need to obtain new ones at SAT.

“Error accesscontrol access denied read” when renewing IDSE certificate: This specific error occurs when Java tries to read certificate files but lacks permissions. It requires editing the java.policy file to add read permissions. See our dedicated article on this error.

“Digital certificate does not match employer registration”: This is not a browser error but a data error. The RFC on your e.firma certificate must match exactly the employer registered with IMSS. Verify the employer RFC on the IMSS portal.

“Error submitting enrollment movements online”: If the portal loads but fails when submitting movements, this may be due to an expired session, network issues, or server maintenance. Try during off-peak hours (before 9 AM or after 6 PM).

Errors importing IDSE files from Aspel NOI: If you generate IDSE files from your payroll software and the portal rejects them, the problem may be in the file format or worker data that does not match the IMSS registry.

Expired e.firma certificate: If your e.firma has expired, no browser configuration will allow you to log into IDSE. Online renewal is only possible while the certificate is still valid — if it has already expired, you must visit SAT in person.

Summary

  • The IDSE IMSS portal was designed for Internet Explorer and Java, technologies that modern browsers no longer support.
  • The recommended solution is Microsoft Edge in Internet Explorer mode with Java JRE 8 configured.
  • SSL errors are resolved by enabling TLS 1.0 and 1.1 in Internet Options (disable them after using IDSE).
  • The e.firma is loaded directly in the portal — you do not need to install it in the browser, but the .cer and .key files must be current.
  • If Edge IE mode does not work, try Firefox ESR or consider a virtual machine with Windows 7 and IE 11.
  • Document the working configuration and keep backups of your e.firma to avoid problems.
  • Renew your e.firma before it expires — after expiration you can only renew it in person at SAT.