We browse dozens of websites daily on our favorite browsers without issue—until an unexpected error brings everything to a halt. One of the more concerning errors you might encounter is NET::ERR_CERT_REVOKED. This error can appear across all major browsers, including Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, and others.
If you’ve landed on this page, chances are you’ve seen the dreaded red warning screen that says “Your connection is not private” and the error code NET::ERR_CERT_REVOKED. This error occurs when your browser detects that a website’s SSL/TLS certificate has been revoked by the Certificate Authority (CA) that issued it. The browser blocks the connection to protect you from potential security risks.
But don’t panic—this guide will explain exactly what this error means, why it happens, and provide step-by-step solutions for both website owners and regular visitors.
What Is NET::ERR_CERT_REVOKED?
SSL/TLS certificates are digital files that authenticate a website’s identity and encrypt all data transmitted between your browser and the server. When you visit a website over HTTPS, your browser checks the site’s certificate to ensure it’s valid and trustworthy.
NET::ERR_CERT_REVOKED means the Certificate Authority has explicitly invalidated (revoked) the SSL certificate for the site you’re trying to visit. This is different from an expired certificate or a certificate that doesn’t match the domain name. Revocation is a deliberate action taken by the CA, and it’s a serious security signal.
Important security warning: Unlike some other certificate errors where proceeding might be safe (like a wrong system clock), you should never proceed to a site showing NET::ERR_CERT_REVOKED unless you’re absolutely certain of the cause and understand the risks. The certificate was revoked for a reason.
What Does the Error Look Like in Different Browsers?
| Browser | Error Message |
|---|---|
| Google Chrome / Edge / Brave | NET::ERR_CERT_REVOKED |
| Mozilla Firefox | SEC_ERROR_REVOKED_CERTIFICATE |
| Safari | “This Connection Is Not Private” |
Despite the different names, the underlying issue is identical—the certificate has been revoked.
Causes of NET::ERR_CERT_REVOKED
There are several reasons why a certificate might be revoked:
The Private Key Has Been Compromised
This is the most serious reason. If a certificate’s private key is stolen or exposed, the CA will revoke the certificate to prevent attackers from impersonating the website.
The Site Owner Requested Revocation
Website owners may request revocation when:
- A server is decommissioned or replaced
- The certificate was issued to the wrong entity
- They’re migrating to a new certificate
Mis issuance by the Certificate Authority
If the CA discovers they issued a certificate incorrectly—for example, to someone who shouldn’t have received it—they will revoke it.
Network or DNS Issues Blocking Revocation Checks
Sometimes, the error appears not because the certificate is actually revoked, but because your browser cannot access the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) servers to verify the certificate’s status.
The Certificate Is on the CRL or OCSP List
Browsers check revocation status through:
- Certificate Revocation Lists (CRL): A list of all revoked certificates that the browser downloads
- Online Certificate Status Protocol (OCSP): The browser queries the CA directly to check if a specific certificate is valid
If the certificate appears on either list, the browser blocks the connection and shows NET::ERR_CERT_REVOKED.
How to Fix NET::ERR_CERT_REVOKED (For Website Owners)
If you’re a website owner or administrator and your own site is showing this error, the problem is server-side. Visitors cannot fix this—only you can.
Check If Your SSL Certificate Has Expired
Certificate lifespans are getting shorter. As of 2026, maximum certificate validity is progressively decreasing to 200, 100, and eventually 47 days. Let’s Encrypt certificates, for example, are valid for only 90 days.
Run this command to check your certificate’s expiry date:
bash openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -dates -subject
Verify Your Certificate Configuration
Sometimes the certificate is valid, but your web server isn’t using it correctly. Common issues include:
- The web server configuration points to an old or self-signed certificate path
- The certificate doesn’t cover all domain variations (e.g., example.com but not www.example.com)
Check your actual server configuration:
bash sudo nginx -T | grep ssl_certificate # For Nginx
Reissue a New SSL Certificate
If the certificate has been revoked, the only permanent fix is to reissue a new SSL certificate from a trusted Certificate Authority such as Let’s Encrypt, Comodo, or DigiCert.
For Let’s Encrypt users:
bash sudo certbot certificates # Check expiry dates sudo certbot renew # Manually renew sudo systemctl reload nginx # Reload web server
Contact Your Hosting Provider
If you’re unsure about the configuration, contact your web hosting provider and ask them to verify that your SSL certificate is properly installed and configured.
Check Certificate Revocation Lists
To understand why your certificate was revoked:
- View the certificate details in your browser
- Find the CRL Distribution Points URL in the Details tab
- Open that URL to download the CRL file
- Check if your certificate’s serial number appears on the revocation list
How to Fix NET::ERR_CERT_REVOKED (For Website Visitors)
As a visitor, your options are limited because the error is usually server-side. However, there are a few things you can try before giving up on the site.
Check Your System Date and Time
This is the most common local cause. If your system clock is incorrect, your browser might misinterpret certificate validity.
On Windows:
- Press Win + I to open Settings
- Go to Time & Language → Date & Time
- Toggle Set time automatically OFF and then ON again
- Click Sync now
On macOS:
- Open System Settings → General → Date & Time
- Toggle Set date and time automatically OFF and ON
On Linux:
bash timedatectl status # Check current time sudo ntpdate -s time.nist.gov # Sync with NTP server
Clear Browser Cache and SSL State
Clear SSL cache on Windows:
- Close all browsers
- Open Internet Options (search for it in the Start menu)
- Go to the Content tab
- Click Clear SSL State
Clear browser cache in Chrome/Edge:
- Press Ctrl + Shift + Delete
- Select Advanced tab
- Check Cookies and other site data and Cached images and files
- Click Clear data
Clear HSTS settings for the domain:
- Go to chrome://net-internals/#hsts
- Under Delete domain security policies, enter the domain
- Click Delete
Try Incognito/Private Mode
Open the site in an incognito or private browsing window. If the error disappears, the issue is likely related to cached data or browser extensions.
Disable Antivirus HTTPS Scanning Temporarily
Some antivirus software intercepts HTTPS connections to scan encrypted traffic, inserting their own certificate. If this certificate isn’t trusted, you’ll see errors.
Look for settings like:
- HTTPS scanning
- Web Shield
- SSL inspection
- Encrypted web scanning
Disable these temporarily and test the site. If it works, update your antivirus or add the site to its exclusion list.
Disable VPN or Proxy
VPNs and proxies can interfere with certificate validation by routing your traffic through different servers. Try disconnecting your VPN or disabling proxy settings and test again.
Try a Different Network
Captive portals (hotel, airport, or coffee shop Wi-Fi) sometimes intercept HTTPS connections before you’ve authenticated, triggering certificate errors. Try switching to a mobile hotspot or a different network.
Update Your Browser and Operating System
Root certificates in older browsers may expire, or CA trust stores might be missing. Ensure that both your browser and operating system are up to date.
Disable Certificate Revocation Checks (Advanced – Use with Caution)
Warning: This reduces your security and should only be used temporarily in development or testing environments.
In Chrome:
- Type chrome://settings/security in the address bar
- Scroll to the Security section
- Find Check for server certificate revocation
- Toggle it OFF
For enterprise environments, this can also be controlled via Group Policy under Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Enable online OCSP/CRL checks.
The “Proceed Anyway” Option
If you’re absolutely certain the site is safe (e.g., an internal development server with a self-signed certificate), you can bypass the warning:
- Click Advanced on the error page
- Click Proceed to [domain] (unsafe)
For Chrome: typing thisisunsafe on the error page will bypass the warning.
Important: Never do this on banking, shopping, or any site where you enter sensitive information. If the certificate was revoked due to a compromised private key, an attacker could be intercepting your traffic.
Quick Troubleshooting Checklist
| Symptom | Likely Cause | Fix |
|---|---|---|
| Error on multiple HTTPS sites | Wrong system clock | Sync date/time |
| Error only on one site | Certificate truly revoked | Contact site owner |
| Error disappears in incognito | Browser cache/extensions | Clear cache, disable extensions |
| Error appears on public Wi-Fi | Captive portal | Authenticate via HTTP page first |
| Error after antivirus update | Antivirus HTTPS inspection | Disable SSL scanning temporarily |
| Error on your own website | Expired or misconfigured cert | Reissue certificate |
Conclusion
The NET::ERR_CERT_REVOKED error is one of the more serious SSL/TLS certificate errors you can encounter. It means a Certificate Authority has deliberately invalidated a website’s security certificate—usually because the private key was compromised, the certificate was misissued, or the site owner requested revocation.
For website owners, the only real solution is to reissue a new SSL certificate from a trusted Certificate Authority and ensure it’s correctly configured on your server.
For visitors, your options are limited. Check your system clock, clear your cache, disable VPNs and antivirus HTTPS scanning, and try a different network. If none of these work, the issue is server-side, and you should contact the site owner.
Remember: Security warnings exist for a reason. Always think twice before bypassing a certificate error—especially one as serious as NET::ERR_CERT_REVOKED.
Frequently Asked Questions
Is NET::ERR_CERT_REVOKED dangerous?
Yes, it can be. Unlike ERR_CERT_DATE_INVALID (which might just mean your clock is wrong), NET::ERR_CERT_REVOKED means the CA explicitly invalidated the certificate. This often happens because the private key was compromised.
Should I proceed to a site with this error?
Generally, no. Only proceed if you’re absolutely certain the site is safe and you understand the risks (e.g., an internal development environment). Never proceed on sites handling sensitive information.
Why does the error appear in Chrome but not Firefox?
Different browsers use different methods and sources for checking certificate revocation. Chrome may be stricter or use a different CRL/OCSP endpoint.
How long does it take for a revoked certificate to be updated?
Revocation information is typically published within hours, but it can take up to 24-48 hours for all browsers and systems to reflect the change.
Can I fix this by renewing my SSL certificate?
Yes, for website owners, reissuing a new certificate from a trusted CA is the definitive fix.
