certificate_revoked
certificate_revoked (44) is sent when a certificate has been revoked by the issuing Certificate Authority. The certificate was valid when issued but has since been revoked – typically because the private key was compromised, the certificate was mis-issued, or the organization no longer controls the domain. Revocation is checked via CRL or OCSP.
Alert Code
44
Level
Fatal
Standard
RFC 8446
Description
certificate_revoked is sent when certificate revocation checking (CRL or OCSP) confirms the certificate has been revoked. In practice, many TLS clients do not perform hard-fail revocation checking due to performance and availability concerns – this is a longstanding security weakness. OCSP stapling (RFC 6066) improves this by having the server include a signed OCSP response in the TLS handshake, avoiding a separate OCSP lookup. Let's Encrypt revokes certificates when private key compromise is reported.
Common Causes
- –Private key was compromised and CA revoked the certificate
- –Certificate was mis-issued and subsequently revoked
- –Domain ownership changed and previous cert was revoked
- –Heartbleed or similar vulnerability led to mass revocation