Chrome does not let you continue
This is what makes revocation different from every other certificate error. There is no "Advanced" route through. Chrome states it plainly:
You cannot visit <SITE> right now because its certificate has been revoked.Only three certificate situations remove the proceed option. The other two are certificate pinning and HSTS. Everything else, including expired, self signed and wrong hostname, still offers "Proceed to <SITE> (unsafe)".
What revocation actually is
A certificate has a fixed expiry date, but the authority that issued it can also cancel it early. That is revocation.
It is a deliberate act by the authority, not something that happens through neglect. Somebody, usually the site owner or the authority itself, decided that this specific certificate must stop being trusted immediately.
Browsers learn about it in two ways: lists of revoked certificates that ship with or are pushed to the browser, and live queries to the authority. Chrome leans on its own pushed list, which is why a revoked certificate can be blocked in Chrome while another browser still lets it through. That difference confuses people, but it does not make the revocation less real.
Why a certificate gets revoked
The reasons that matter to a visitor:
- →The private key was compromised. The secret half of the certificate leaked, was stolen, or was exposed in a breach or a public code repository. Anyone holding it could impersonate the site, which is exactly why revocation exists.
- →The certificate was mis-issued. The authority discovered it should never have been granted, for example because the domain ownership check was flawed or the details were wrong.
- →The server itself was compromised. If attackers got into the server, they may have got the key with it, so the certificate is revoked as a precaution.
- →The domain changed hands or the details are no longer accurate. The organisation named on the certificate no longer controls the domain.
- →Routine replacement done properly. Owners sometimes revoke an old certificate after replacing it. This is the harmless case, but you have no way to tell it apart from the others as a visitor.
Revoked is not the same as expired
People lump these together and they should not.
An expired certificate is a missed deadline. It is usually an administrative slip and the browser still lets you make your own decision about it.
A revoked certificate is an authority actively withdrawing trust in that specific certificate while it would otherwise still be valid. Somebody decided it was unsafe. Chrome takes the decision out of your hands, which tells you how the browser rates it.
If you want the background on who issues certificates and what withdrawing one means, see our guides to certificate authorities and SSL certificates.
If it is your site: what to do, in order
The order matters, because replacing the certificate without finding the cause can leave you in the same position within days.
- 1.Ask your certificate authority why. They know the revocation reason and it decides everything that follows. Key compromise and a routine replacement need very different responses.
- 2.Assume the private key is exposed until the authority tells you otherwise. Generate a completely new key pair. Never reuse the old key or an old certificate signing request.
- 3.Look for how it leaked. Check whether a key file ended up in a code repository, a backup, a shared drive, or an email. Check server access logs and administrator accounts for anything you do not recognise.
- 4.Install the new certificate everywhere. Every web server, load balancer and CDN that terminates connections, then reload each one so the change takes effect.
- 5.Rotate everything else the server holds. If the machine was compromised, database passwords, API keys and admin logins are all suspect too.
- 6.Verify from outside. Use the checker at the top of this page. It reports what a visitor actually receives, which is the only test that counts.
What our check can tell you
Our engine inspects the certificate a site presents and reports the precise reason it is not trusted, including whether it has expired, is self signed, is not issued by a trusted authority, or does not match this website address. That is the same information the checker box on this page shows you.
It means you can diagnose a site without opening it, which matters more here than on any other certificate error, because with revocation you genuinely should not be loading the page.
Frequently asked questions
Can I bypass NET::ERR_CERT_REVOKED?
No. Chrome removes the proceed option entirely and shows the message "You cannot visit <SITE> right now because its certificate has been revoked." Revocation is one of only three certificate situations with no override, alongside HSTS and certificate pinning. Any guide offering a workaround is telling you to disable a protection that exists for a good reason.
Is a revoked certificate worse than an expired one?
Yes, and it is worth understanding why. Expiry is a deadline passing, usually through neglect. Revocation is the issuing authority deciding this specific certificate must stop being trusted right now, most often because a private key was compromised or the certificate was issued incorrectly. Chrome reflects that difference by removing your ability to continue.
The site works in another browser. Does that mean it is fine?
No. Browsers check revocation differently, and Chrome relies heavily on lists pushed directly to it, so it often blocks a revoked certificate that another browser still accepts. The certificate has still been withdrawn. Do not use that as permission to enter your details.
I had an account on that site. What should I do?
Change that password, and change it anywhere else you reused it. If you entered payment details recently, watch the card and report anything unexpected to your bank. Contact the business by phone or through an app rather than through the site, and be wary of any email that arrives claiming to help you with the problem.
It is my certificate and I did not revoke it. Who did?
Either your certificate authority did, or someone with access to your account there. Contact the authority immediately and ask for the revocation reason, then check who else can reach that account. Authorities revoke on their own initiative when they learn a key is exposed or a certificate was mis-issued, and they will tell you which applies.