Git ssl-certificate-revoked The certificate presented by the server was rejected because its issuer revoked it.

dev@local: ~/project — git

dev@local~/project$git status

error: ssl certificate revoked

Diagnostics Translation

The certificate presented by the server was rejected because its issuer revoked it.

waiting for resolution...

MediumVersion Control System

Reviewed for reference consistency: August 11, 2026

Code is Safe

SECURE

Git has paused the operation to protect your code. No data has been lost or corrupted.

What To Know

The server's certificate was actively revoked by its issuer — a stronger verdict than an unknown chain — and the TLS layer ended the connection before Git sent anything.

Where Did It Fail?

Working Tree

Your local files

add

Staging Index

Prepared changes

commit

Local Repo

Commit history

push/fetch

Remote Server

GitHub/GitLab

Git halted to protect the uncommitted files in your active working directory.

Commands That Trigger This

A hosting service rotating certificates after an incident while clients cache the old one

A corporate TLS appliance serving a certificate the upstream CA has revoked

A self-hosted server whose certificate was revoked after a validation lapse

Technical Background

Revocation is a deliberate act by the certificate's issuer, so this failure carries a security judgment that unknown-chain errors do not: the identity was once valid and was withdrawn. The client's refusal is the working-as-intended outcome of that withdrawal.

The wording splits along TLS backends: builds linked against OpenSSL report the status through libcurl's certificate-problem text, while Windows schannel names CRYPT_E_REVOKED explicitly. Both descriptions trace to the same verification decision.

If the certificate belongs to a proxy rather than the real host, the revocation is a symptom of interception — the network path, not the repository host, is what got rejected.

Underlying Causes

The server keeps serving a certificate the issuing CA has revoked

A TLS-intercepting proxy presents its own revoked or misissued certificate

Revocation checking over CRL or OCSP returned a definitive revoked status

A captive middlebox re-signs traffic with a certificate lacking valid revocation data

Frequently Asked Questions

No. Revocation is a property of the certificate itself; the server must present a replacement certificate before clients will accept the connection.

Revocation checking differs by TLS backend and configuration — schannel enforces it by default, while OpenSSL-based builds check only when revocation data is available.

Related Git States

rpc-failed-curlMedium

The underlying HTTP client (cURL) failed to complete the network request.

ssl-unable-to-get-local-issuer-certificateMedium

The TLS layer found no trusted issuer to complete the server's certificate chain.

server-certificate-verification-failedMedium

TLS verification of the remote host failed outright, naming the CA file and CRL file.