tls.cert.revoked

Certificate Revoked

What we check

We query the certificate authority's revocation endpoints — the OCSP responder and/or CRL distribution point named in the certificate — to ask whether the certificate has been revoked. Only a signed statement from the authority produces this result.

What this finding means

The certificate authority has explicitly revoked this certificate. Revocation means the CA no longer vouches for it, regardless of whether it is within its validity period. Common reasons for revocation: the private key was compromised, the certificate was misissued, or the domain ownership changed.

Why it matters

The certificate is untrustworthy. The CA's revocation is an authoritative statement that this certificate should no longer be accepted. Senders that check revocation status will refuse to deliver.
Possible key compromise. Revocation often follows a suspected or confirmed private-key leak. If the key was compromised, an attacker could impersonate the server.
Immediate action required. A revoked certificate is worse than an expired one — it signals an active security concern, not just neglected maintenance.

How to fix

Obtain a new certificate immediately. Do not attempt to "un-revoke" the old one — revocation is permanent.

# Revoke the old cert formally if not already done, then get a new one
certbot revoke --cert-path /etc/letsencrypt/live/mail.example.com/cert.pem
certbot certonly --standalone -d mail.example.com

Investigate the cause. If the key was compromised, generate a new private key (certbot does this by default on renewal). Check for unauthorized access to the server.
Deploy and reload:
```
systemctl reload postfix
```

Verify revocation status of the new certificate:

openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com 2>/dev/null | \
    openssl x509 -noout -serial -issuer
# Then check the serial against the CA's CRL or OCSP

How it's graded

A revoked certificate is a critical failure. The grading impact depends on the overall TLS assessment — the certificate is effectively invalid. See Grading Methodology for the full scoring model.

Evidence example

Certificate serial: 03:A1:B2:C3:D4:E5:F6
Revocation source: OCSP responder
Status: revoked
Detail: keyCompromise (2026-07-15 14:30:00 UTC)