Skip to content
On this page

SSL issues

Certificate has been revoked ​

Your SSL certificate has been explicitly invalidated by the certificate authority that issued it. Browsers check revocation status and refuse to trust revoked certificates.

Symptom ​

  • DomainDash marks the SSL check as Invalid and the site shows a Security problem badge. The Security card reads "Your certificate has been cancelled by the provider. You'll need a new one."
  • Visitors see a browser warning like NET::ERR_CERT_REVOKED
  • An OCSP query (openssl ocsp -issuer issuer.pem -cert cert.pem -url <ocsp-url>) returns revoked. For a certificate with no OCSP URL (Let's Encrypt), crt.sh or the CRL lists it as revoked

What it means ​

Certificate revocation is the CA's "kill switch" for a certificate. Once it's revoked, browsers and other clients refuse the certificate even though the dates and signature are otherwise valid. The CA distributes revocation status via OCSP (Online Certificate Status Protocol) and CRLs (Certificate Revocation Lists). Let's Encrypt stopped publishing OCSP in 2025 and uses CRLs only. Revocation is deliberate: something made the CA decide the certificate should no longer be trusted, so find out what before you reissue.

Common causes ​

  • The private key was compromised. Either you or the CA revoked the certificate to prevent misuse.
  • You requested revocation manually (e.g. via certbot revoke) but didn't replace it with a new certificate, or the replacement isn't being served.
  • The CA revoked it for a policy violation, such as mis-issuance, domain validation that turned out to be invalid, or a CA-side security incident.
  • Your domain registration changed hands and the previous owner's certificate was revoked when domain validation (a DNS record, a file on the site, or an email to an admin address) failed.
  • A CA-wide revocation event. Rare, but it happens (e.g. when a CA distrusts a batch of certificates after a security incident).

How to fix ​

  1. Confirm the revocation. Find your certificate's issuer, OCSP URL and CRL URL:

    bash
    openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E "OCSP|Issuer|URI:"

    If there is an OCSP URL, query it directly using openssl ocsp. The response will indicate good, revoked, or unknown. If there is no OCSP URL (Let's Encrypt), look the certificate up on crt.sh, or check it against the CRL URL in the certificate.

  2. Find out why. For Let's Encrypt, check your ACME client's logs (certbot's are in /var/log/letsencrypt/) and the certificate's record on crt.sh. For a commercial CA, check your account dashboard. Commercial CAs typically email the account holder. If your private key was compromised, treat this as a security incident before issuing anything new.

  3. Use a new private key if the existing key was the reason for revocation. Don't reuse a compromised key. Certbot generates a new key each time it issues a certificate, unless you've set --reuse-key. For a certificate you manage by hand, generate one and create your certificate request from it:

    bash
    openssl genrsa -out new-key.pem 2048

  4. Issue a fresh certificate. For Let's Encrypt with certbot:

    bash
    sudo certbot certonly --nginx -d example.com -d www.example.com --force-renewal

    For other CAs, submit a new request made from the new key.

  5. Replace the cert on your server and reload the web server. Make sure the old, revoked cert file is removed or moved aside so it can't be served by mistake.

How to verify ​

  1. Re-run the check from step 1 against the new certificate. An OCSP response should be good. On crt.sh or the CRL, the new certificate should not be listed as revoked.
  2. Open the site in an incognito window. The padlock should appear with no warnings.
  3. Open the site in DomainDash. The next scheduled SSL check (every 6 to 24 hours, depending on your plan) picks up the new certificate, marks it Valid and clears the Security problem badge. If the problem had also taken the site Down, DomainDash re-checks the certificate as soon as the site recovers, so the badge clears within minutes.

Catch this automatically

DomainDash keeps an eye on this for you — and tells you in plain English the moment something needs your attention, before your visitors notice. Set up in under a minute, no credit card.

Get started free See SSL certificate monitoring
PreviousCertificate signed by an untrusted authorityNextCertificate signature is invalid

Last updated: 13 October 2026