Replace the revoked certificate and its key on Cloudflare
Why it matters
The CA has revoked this certificate, so browsers and clients that check revocation refuse it, and the revocation may mean its private key is in someone else's hands. The server keeps sending it until a new certificate is installed.
The fix
- If the record is Proxied (orange cloud), visitors get Cloudflare's edge certificate; a revoked edge certificate is replaced by Cloudflare. Check SSL/TLS then Edge Certificates and contact support if it is not.
- If you uploaded a custom certificate, issue a new one with a new key at your CA and upload it under SSL/TLS then Edge Certificates.
- For DNS-only records, replace the certificate on your server using the generic steps.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.