NET::ERR_CERT_REVOKED, what it means and what to do
Revocation is the emergency brake of the certificate system: the issuing authority has declared this certificate invalid before its expiry date, typically because its private key leaked, it was issued by mistake, or the operator asked to kill it. The browser checked the authority's revocation list or OCSP responder and found this certificate on it. Unlike expiry, revocation is deliberate, and it is final.
The fix, in order
- Stop and do not use the site for anything sensitive. A revoked certificate may be in hostile hands; that is the usual reason for revocation. There is no step on your side that makes the connection trustworthy again.
- Try the site on another device to rule out a stale local cache. Browsers cache revocation information briefly. If a second device on a different network loads the site fine, clear your browser's cached state and try later; if it also reports revoked, the revocation is real and current.
- Check the site's official channels for an announcement. Operators who revoke usually replace the certificate within hours. If their status page or social account mentions certificate work, waiting is the correct action.
- If it is your site, replace the certificate and find out why it was revoked. Reissue from the authority, install the new certificate everywhere the old one was used, and treat an unexplained revocation as a security incident: the key may be compromised, so generate a fresh key pair rather than reusing the old one.
There is no safe “proceed anyway” for a revoked certificate. Expiry can be an oversight; revocation is the authority explicitly saying this credential must not be trusted anymore. Entering credentials past this warning is exactly the situation revocation exists to prevent.
If it still happens
Revocations cascade: when an authority revokes an intermediate or a batch of certificates after an incident, many unrelated sites can show this error in the same week. In that case the sites are victims of the same event and will come back as they reissue; the advice does not change: wait, do not bypass.
Common questions
What is the difference between revoked and expired? Expired means the certificate reached the end of its scheduled life, routine and expected. Revoked means the authority cancelled it early, usually for a security reason. Browsers treat revocation as the more serious signal, and so should visitors.
Could a revoked error be a mistake? Occasionally an authority revokes in error or a stale revocation response gets cached, and sites recover once they reissue. But from the visitor's side a mistake and a genuine compromise look identical, which is why the correct response is to wait rather than to push through.
Related errors