ERR_CERT_REVOKED means the browser checked the certificate's revocation status (via CRL or OCSP) and found that the Certificate Authority has explicitly revoked it. Certificate revocation happens when a certificate's private key is compromised, the certificate was fraudulently issued, the domain ownership changed, or the organization requested revocation. Once revoked, the certificate is permanently invalidated regardless of its expiration date. Browsers that check revocation status will refuse to establish a connection with a revoked certificate because it can no longer be trusted to authenticate the server.
If the server's private key was exposed (through a security breach, accidental publication, or server compromise), the Certificate Authority revokes the certificate to prevent its misuse. The site owner or the CA may have initiated the revocation.
When a new certificate is issued to replace an existing one, the CA often revokes the old certificate. If the server is still serving the old certificate instead of the new one, browsers will see it as revoked.
Certificate Authorities sometimes perform mass revocations when they discover that certificates were issued improperly (e.g., without proper domain validation or with technical flaws). This has affected thousands of certificates at once in past incidents.
Check the certificate's OCSP responder to confirm whether the certificate is actually revoked. The OCSP URL is embedded in the certificate's Authority Information Access extension.
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -ocsp_uri
Download the Certificate Revocation List from the CA and check if your certificate's serial number appears in it.
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -serial
A revoked certificate cannot be un-revoked. You must obtain a new certificate. Generate a new private key (do not reuse the potentially compromised one), create a new CSR, and request a fresh certificate from your CA.
openssl genrsa -out new-key.pem 2048 && openssl req -new -key new-key.pem -out new-csr.pem
Replace the old certificate and key files on your server with the new ones. Restart or reload the web server to pick up the changes.
sudo systemctl reload nginx
The browser does not trust the Certificate Authority that signed the server's SSL certificate.
The TLS peer determined that the presented certificate has been revoked by its issuing Certificate Authority.
The server's SSL/TLS certificate has expired or is not yet valid according to the system clock.