{"record":{"id":"f178d229ade6b677","repo":"eclipse-vertx/vert.x","slug":"certificate-revoked","errorCode":null,"errorMessage":"Certificate revoked","messagePattern":"Certificate revoked","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"critical","filePath":"vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextProvider.java","lineNumber":197,"sourceCode":"      TrustManager trustMgr = trustMgrs[i];\n      if (trustMgr instanceof X509TrustManager) {\n        X509TrustManager x509TrustManager = (X509TrustManager) trustMgr;\n        trustMgrs[i] = new X509TrustManager() {\n          @Override\n          public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {\n            checkRevoked(x509Certificates);\n            x509TrustManager.checkClientTrusted(x509Certificates, s);\n          }\n          @Override\n          public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {\n            checkRevoked(x509Certificates);\n            x509TrustManager.checkServerTrusted(x509Certificates, s);\n          }\n          private void checkRevoked(X509Certificate[] x509Certificates) throws CertificateException {\n            for (X509Certificate cert : x509Certificates) {\n              for (CRL crl : crls) {\n                if (crl.isRevoked(cert)) {\n                  throw new CertificateException(\"Certificate revoked\");\n                }\n              }\n            }\n          }\n          @Override\n          public X509Certificate[] getAcceptedIssuers() {\n            return x509TrustManager.getAcceptedIssuers();\n          }\n        };\n      }\n    }\n    return trustMgrs;\n  }\n}\n","sourceCodeStart":179,"sourceCodeEnd":212,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextProvider.java#L179-L212","documentation":"During TLS trust verification, the wrapped X509TrustManager checks each certificate against the configured CRLs (certificate revocation lists); if crl.isRevoked(cert) is true it throws CertificateException(\"Certificate revoked\"), causing the handshake to fail because the peer presented a revoked certificate.","triggerScenarios":"TLS handshake where the remote peer's certificate (or any cert in its chain) appears in a CRL supplied via TrustOptions.setCrlPath/setCrlValues; invoked from checkClientTrusted or checkServerTrusted.","commonSituations":"Server certificate revoked by its CA after key compromise or domain ownership change; client mTLS certificate revoked on employee offboarding; stale CRL copied into deployment mistakenly flagging certs.","solutions":["Obtain a new certificate from the CA and replace the revoked one on the peer.","Update the CRL files (crlPath) to the latest issued by the CA and redeploy.","Verify the CRL belongs to the same CA as the cert chain — a mismatched/stale CRL can cause false positives.","Remove the revoked certificate from the trusted/allowed material if it was mistakenly pinned."],"exampleFix":"// before\nTrustOptions trust = new JksOptions().setPath(\"trust.jks\").setCrlPath(\"stale.crl\");\n// after\nTrustOptions trust = new JksOptions().setPath(\"trust.jks\").setCrlPath(\"current-2026.crl\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { handshake/connect... } catch (SSLHandshakeException e) {\n  if (e.getCause() instanceof CertificateException && String.valueOf(e.getCause().getMessage()).contains(\"revoked\")) {\n    // rotate certificate / refresh CRL\n  }\n}","preventionTips":["Monitor certificate expiry/revocation on all deployed peers","Automate CRL refresh from the CA distribution point","Rotate certificates before revocation events (planned key rotations)","Alert on handshake failures mentioning revoked certificates"],"tags":["tls","certificate","revocation","crl","security"],"backgroundTag":"certificate-revoked","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}