Browser errors
NET::ERR_CERT_REVOKED: certificate revoked, what to do
NET::ERR_CERT_REVOKEDNET::ERR_CERT_REVOKED means the certificate authority has cancelled this certificate before it expired, and the browser knows about it. This is a site-side problem. There is no safe workaround for visitors, and Chrome deliberately offers no "Proceed" link.
Is it the site or your device?
Revocation is a property of the certificate, so this error almost always belongs to the site. Confirm with the SSL checker:
curl ssl.sh/example.com
The one visitor-side exception is HTTPS interception: if antivirus software or a corporate proxy re-signs traffic and its own certificate or intermediate is revoked, every intercepted site shows this error. Check whether the issuer in the certificate viewer is the real CA or a security product.
Causes
1. The owner revoked it and kept serving it
After reissuing (for example after moving servers or rotating a key), the old certificate was revoked but a server, CDN edge or load balancer still presents it. Compare the serial number in the browser with the one you installed:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -serial -dates -issuer
2. Private key compromise
If the key leaked (committed to a public repository, a breached server), the owner or the CA revokes the certificate. Generate a new key, never reuse the leaked one.
3. CA incident or mis-issuance
CAs must revoke certificates issued in violation of the Baseline Requirements, sometimes within 24 hours or five days. Several CAs have performed mass revocations over the years after validation bugs. Your CA will usually email the account contact before revoking.
4. Revoked intermediate
If the intermediate CA certificate itself was revoked, every certificate under it fails. Replace both the certificate and the chain file.
5. Interception product with a revoked certificate
This is rare, but outdated security appliances sometimes use a revoked intermediate. Update the product or contact IT.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Chrome / Edge | "Your connection is not private" with NET::ERR_CERT_REVOKED, no proceed option |
| Firefox | "Secure Connection Failed" with SEC_ERROR_REVOKED_CERTIFICATE |
| Safari | "This Connection Is Not Private"; certificate details say the certificate has been revoked |
| curl / OpenSSL | Revocation is not checked by default, so curl may still connect |
How site owners fix it
Issue a new certificate, with a new key if the old one leaked, and replace the revoked one everywhere.
1. Find out why. Check your CA account and email for a revocation notice; the reason code tells you whether the key must change.
2. Issue a new certificate. With a new key when compromise is involved:
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.com.key -out example.com.csr -subj "/CN=example.com"
Or let your ACME client generate a fresh key: certbot certonly --nginx -d example.com --force-renewal.
3. Replace it everywhere. Origin servers, CDNs, load balancers, mail servers and appliances each hold a copy. Decode what each endpoint serves with the certificate decoder and confirm the serial number changed.
4. Verify. Run curl ssl.sh/example.com and confirm the new serial number and dates. Learn more in OCSP and CRL.
FAQ
Can I proceed to a site with a revoked certificate?
No, and you should not want to. A revoked certificate may have a stolen private key, which means someone else could be impersonating the site. Wait for the owner to install a new certificate.
Why does the site work in one browser but show revoked in another?
Browsers receive revocation data on different schedules and through different mechanisms. Chrome uses CRLSets, Firefox uses CRLite and OCSP, and Safari uses Apple's own system. A recently revoked certificate can appear valid in one and revoked in another for a short time.
I renewed my certificate. Can I keep using the old one until it expires?
Only if it was not revoked. If you or the CA revoked it, remove it from every server, CDN and load balancer immediately; any copy left in service will show this error.
Do I need a new private key?
If the revocation reason is key compromise, yes: generate a new key and CSR. For other reasons, such as a CA mis-issuance incident, reusing the key is allowed but a fresh key is still good practice.