NET::ERR_CERT_REVOKED

Where you see it

As a full-page warning in Chrome, Edge and other Chromium browsers. The code is ERR_CERT_REVOKED (−206) in Chromium’s network error list.

Your connection is not private
Attackers might be trying to steal your information from www.example.com (for example, passwords, messages, or credit cards). Learn more about this warning
NET::ERR_CERT_REVOKED

Under Advanced, Chrome explains (Chromium strings):

You cannot visit www.example.com right now because its certificate has been revoked. Network errors and attacks are usually temporary, so this page will probably work later.

Unlike most certificate warnings, this one has no “Proceed” link: Chromium treats a revoked certificate as a fatal error (ssl_error_options_mask.cc). Firefox reports a revoked certificate as SEC_ERROR_REVOKED_CERTIFICATE.

What it means

Revocation is how a CA withdraws a certificate before its end date, for example because its private key leaked or it was issued by mistake. The CA publishes the revocation in a certificate revocation list (CRL) and, if it runs one, through an OCSP responder. Chrome does not normally check OCSP or CRLs online; it relies on CRLSets, a revocation list it pushes to browsers. So when Chrome shows this error, the certificate (or a CA certificate above it) is in Chrome’s CRLSet, or, where online checks are turned on (see the last cause below), the CA reported it as revoked. Chrome then refuses to use it.

This is rarely a problem with your device. It is the site owner’s job to fix.

Likely causes

The site still serves a certificate that was replaced and revoked

The most common cause. Someone renewed or re-issued the certificate and revoked the old one, but a load balancer, CDN, second server or forgotten appliance still serves the old certificate.

Confirm which certificate is served, and compare its serial number with the new one:

openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -serial -enddate
openssl x509 -in /etc/ssl/www.example.com/fullchain.pem -noout -serial -enddate

Fix: install the new certificate with its full chain everywhere TLS ends, reload each service, and test every node directly, for example with openssl s_client -connect 192.0.2.31:443 -servername www.example.com.

The CA revoked the certificate

CAs must revoke a certificate within 24 hours when its key is compromised or the domain validation turns out to be unreliable, and within 5 days for other reasons, such as a certificate issued against the rules or with wrong details (TLS Baseline Requirements, section 4.9.1.1). If you did not ask for the revocation, contact your CA to learn the reason.

Confirm the status yourself with the CA’s CRL. Find its address, download it and check the certificate against it (issuing-ca.pem is the intermediate that signed it):

openssl x509 -in server.pem -noout -serial -ext crlDistributionPoints
curl -sS -o ca.crl http://crl.ca.example/issuing-ca.crl
openssl crl -inform DER -in ca.crl -out ca-crl.pem
openssl verify -crl_check -partial_chain -CAfile issuing-ca.pem -CRLfile ca-crl.pem server.pem

CN=www.example.com
error 23 at 0 depth lookup: certificate revoked
error server.pem: verification failed

A certificate that is not revoked prints server.pem: OK. Many public certificates no longer contain an OCSP address; Let's Encrypt has shut down its OCSP service, for example.

Fix: get a new certificate. If the key was compromised, generate a new private key and CSR; never reuse the old key. Deploy it everywhere and reload. See How to create a key and a CSR with OpenSSL and How to install a certificate in nginx.

An intermediate in the chain was revoked

If your own certificate is fine, the CA certificate above it may be revoked or distrusted. Check the issuer of each certificate the server sends (openssl s_client -showcerts), then download the CA’s current chain, rebuild your chain file and reload. See How to build the full chain file your server needs.

Your company turned on online revocation checks

Managed Chrome can be told to check OCSP and CRLs online with the EnableOnlineRevocationChecks and RequireOnlineRevocationChecksForLocalAnchors policies. With the second one, Chrome treats certificates from locally installed CAs as revoked when it cannot get their status (policy description). Internal sites can then fail when the private CA revoked a certificate, or when its CRL is out of date or out of reach.

Fix: re-issue the certificate from your private CA, and keep the CA’s CRL published, current and reachable from every client.

Check yours

Try it: Certificate decoderOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste a certificate

Try a sampleChoose a sample…A website certificate (www.example.com)An expired certificateA wildcard certificate (*.example.com)A certificate with a Common Name but no SANA self-signed root CAA complete chain: leaf, intermediate and root

-----BEGIN CERTIFICATE----- MIIC1zCCAnygAwIBAgIQWTTOzqWiPshGdQhNb6kmNjAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEw4og6Y/SOr+WrqSv+ng7tOBEsc5N3A3yZRk+9hsR XzPQvB9672aHZHTYFNlSY93RWVcTRieE+8XnIbWIYfwxIqOCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FALMipe4vcXJTpwO926S15Y/bobzMB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSQAwRgIhAM5dJUPhL+qV artvWtQinfnykhVflJTjMXe8M6PnqQfaAiEAhOLGj1hSEkNxQoMrYNXRaIe69nq6 2unibVFSVw1AC80= -----END CERTIFICATE-----

PEM text, several PEM blocks, or a .pem, .crt, .cer or .der file (drop it on the box). Certificates are public, so they are safe to paste.

DecodeClearChoose a file

Paste the certificate the server sends. The decoder shows its serial number, issuer and CRL address, so you can check it against the CA’s list.

Learn why

• Taking it back: CRLs, OCSP and stapling: how revocation works, and why browsers mostly soft-fail.
• Inventory, expiry and renewal: replacing certificates everywhere they are used.
• Related: verify error:num=10:certificate has expired.

In the gameLevel 16: Taking it backWatchtower, Keystone. In development