Replace the revoked certificate and its key

tls.cert.revoked · effort: minutes

Why it matters

The CA has revoked this certificate, so browsers and clients that check revocation refuse it, and the revocation may mean its private key is in someone else's hands. The server keeps sending it until a new certificate is installed.

The fix

  1. Read the finding detail for the revocation date and reason. keyCompromise means the private key must be treated as leaked, so never reuse it.
  2. Generate a new private key and request a new certificate for it. With certbot, force a renewal with a fresh key (the command below); with a purchased certificate, send the CA a new signing request.
  3. Install the new certificate with its intermediate chain and reload the web server. Remove the old key from the server, backups and any other host that used it.
  4. Confirm with the command below that the server now presents a different serial number, then rescan.
bash 
# renew with a new key (certbot), then reload the web server
sudo certbot certificates    # shows the certificate name to use below
sudo certbot renew --cert-name <name> --force-renewal --new-key
sudo systemctl reload nginx    # or apache2 / httpd

# the serial now served (it must differ from the revoked one)
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -serial -dates

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.