This error means the browser checked the certificate's revocation status (via OCSP or CRL) and found it's been explicitly revoked by the issuing CA — a deliberate invalidation, not an expiry or configuration issue.
What to do
If you didn't intentionally revoke this certificate, this is worth investigating immediately — it could indicate the certificate was revoked as part of a broader CA security action, or that something unexpected happened to your certificate through your CA account. If you did revoke it deliberately (following a suspected key compromise, for example), the fix is simply completing the reissuance process with a fresh certificate and key pair, as covered in our revocation guide.
What this error means and why it should never simply be bypassed
This error means the certificate has been explicitly revoked by its issuing CA, typically due to a confirmed or suspected private key compromise — unlike some other certificate warnings that might reflect a benign misconfiguration, a revocation is a deliberate signal that this specific certificate should no longer be trusted, and should never be clicked through.
How to check why a specific certificate was revoked if you're the site owner
Checking your CA account's issuance and revocation history, or contacting your CA directly if the revocation wasn't something your own team initiated, clarifies whether this was a deliberate action (a suspected compromise) or, in rarer cases, a CA-side error worth disputing.
What to do if you're a legitimate visitor encountering this on a site you trust
If a normally trustworthy site suddenly shows a revocation error, this could reflect the site owner's own deliberate, appropriate response to a suspected compromise — checking the site's own status page or social media for any related announcement, or simply avoiding the site until it's resolved, is the safest approach rather than clicking through.
How revocation checking sometimes fails to catch a revoked certificate at all
As covered in more depth in our OCSP and CRL comparison article, revocation checking has genuine practical gaps — some clients soft-fail an unreachable OCSP check rather than treating it as revoked, meaning a revoked certificate can occasionally still be accepted by a client that couldn't successfully complete its revocation check.
A final note for whoever manages the affected certificate
If you're the one managing a certificate that needed revocation, following the complete process covered in our dedicated revocation guide, immediate reissuance with a fresh key pair alongside the revocation itself, ensures visitors experience only a brief transition rather than an extended period without a working, trusted certificate.
What the exact steps look like for a site owner responding to their own certificate's revocation
Confirm the revocation was intentional (your own action, in response to a suspected compromise) rather than an error, generate a fresh key pair, request and install a new certificate immediately, and update every system referencing the old certificate — a clear, sequential response process worth having documented in advance.
How to check whether your specific revocation reason affects the response urgency
A revocation reason of keyCompromise warrants the most urgent possible response, immediate reissuance and investigation into how the compromise occurred, while a reason like superseded or cessationOfOperation reflects a more routine, less urgent administrative action — checking the specific reason clarifies how urgently to treat the situation.
A quick closing checklist
A quick closing checklist covers never clicking through this specific warning, confirming with the site owner or checking their status page if you're a legitimate visitor, and following a documented, immediate reissuance process if you're the one managing the affected certificate.
Why understanding the specific revocation mechanism helps you respond appropriately
Knowing whether your infrastructure actually enforces revocation checking via OCSP or CRL, covered in more depth in our dedicated revocation comparison article, helps you understand whether visitors will reliably see this warning immediately after a revocation or whether some clients might not catch it right away.