ERR_CERT_REVOKED: The certificate was revoked by its issuer

The CA has explicitly revoked this certificate — usually because the private key was compromised, the certificate was reissued, or the domain validation was withdrawn. Renewing is not enough; the revoked certificate must stop being served.

Short answer

The CA has explicitly revoked this certificate — usually because the private key was compromised, the certificate was reissued, or the domain validation was withdrawn. Renewing is not enough; the revoked certificate must stop being served.

What ERR_CERT_REVOKED means

Revocation is published via CRL and OCSP. Once a browser sees a revoked serial it refuses the connection with no bypass, because revocation is the mechanism used after a key compromise.

Causes and fixes, most likely first

1. A replacement certificate was issued and the old one revoked, but the server still serves the old file. Deploy the new certificate and reload. Confirm with an external check that the served serial matches the new certificate.
2. The private key was exposed and the CA revoked it. Generate a completely new key pair — never reuse the compromised key — and reissue.

How to stop it happening again

• Track the served certificate's serial number so a stale file is caught immediately after any reissue.

Check your own domain

The SSL check reports the serial and revocation status of the certificate actually being served, which is the only way to confirm the old one is gone.

Frequently asked questions

Can I bypass a revoked certificate?

No, and you should not want to. Revocation is the mechanism used after key compromise; the certificate must be replaced.