# NET::ERR_CERT_REVOKED: certificate revoked, what to do

> NET::ERR_CERT_REVOKED means the CA has cancelled the site's certificate. Visitors should not continue; site owners must issue and install a new one.

Source: https://ssl.sh/errors/net-err-cert-revoked/
Last updated: 2026-11-10

**NET::ERR_CERT_REVOKED means the certificate authority has cancelled this certificate before it expired, and the browser knows about it.** This is a site-side problem. There is no safe workaround for visitors, and Chrome deliberately offers no "Proceed" link.

## Is it the site or your device?

Revocation is a property of the certificate, so this error almost always belongs to the site. Confirm with the [SSL checker](https://ssl.sh/tools/ssl-checker/):

```bash
curl ssl.sh/example.com
```

The one visitor-side exception is HTTPS interception: if antivirus software or a corporate proxy re-signs traffic and its own certificate or intermediate is revoked, every intercepted site shows this error. Check whether the issuer in the certificate viewer is the real CA or a security product.

## Causes

### 1. The owner revoked it and kept serving it

After reissuing (for example after moving servers or rotating a key), the old certificate was revoked but a server, CDN edge or load balancer still presents it. Compare the serial number in the browser with the one you installed:

```bash
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -serial -dates -issuer
```

### 2. Private key compromise

If the key leaked (committed to a public repository, a breached server), the owner or the CA revokes the certificate. Generate a new key, never reuse the leaked one.

### 3. CA incident or mis-issuance

CAs must revoke certificates issued in violation of the Baseline Requirements, sometimes within 24 hours or five days. Several CAs have performed mass revocations over the years after validation bugs. Your CA will usually email the account contact before revoking.

### 4. Revoked intermediate

If the intermediate CA certificate itself was revoked, every certificate under it fails. Replace both the certificate and the chain file.

### 5. Interception product with a revoked certificate

This is rare, but outdated security appliances sometimes use a revoked intermediate. Update the product or contact IT.

## What it looks like in each browser

| Browser | What you see |
|---|---|
| Chrome / Edge | "Your connection is not private" with `NET::ERR_CERT_REVOKED`, no proceed option |
| Firefox | "Secure Connection Failed" with `SEC_ERROR_REVOKED_CERTIFICATE` |
| Safari | "This Connection Is Not Private"; certificate details say the certificate has been revoked |
| curl / OpenSSL | Revocation is not checked by default, so curl may still connect |

## How site owners fix it

Issue a new certificate, with a new key if the old one leaked, and replace the revoked one everywhere.

**1. Find out why.** Check your CA account and email for a revocation notice; the reason code tells you whether the key must change.

**2. Issue a new certificate.** With a new key when compromise is involved:

```bash
openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr -subj "/CN=example.com"
```

Or let your ACME client generate a fresh key: `certbot certonly --nginx -d example.com --force-renewal`.

**3. Replace it everywhere.** Origin servers, CDNs, load balancers, mail servers and appliances each hold a copy. Decode what each endpoint serves with the [certificate decoder](https://ssl.sh/tools/certificate-decoder/) and confirm the serial number changed.

**4. Verify.** Run `curl ssl.sh/example.com` and confirm the new serial number and dates. Learn more in [OCSP and CRL](https://ssl.sh/learn/ocsp-and-crl/).