{"record":{"id":"f24cac02f2a3301d","repo":"crowdsecurity/crowdsec","slug":"certificate-revoked-by-ocsp","errorCode":null,"errorMessage":"certificate revoked by OCSP","messagePattern":"certificate revoked by OCSP","errorType":"http","errorClass":null,"httpStatus":401,"severity":"critical","filePath":"pkg/apiserver/middlewares/v1/tls_auth.go","lineNumber":55,"sourceCode":"}\n\n// checkRevocationPath checks a single chain against OCSP and CRL\n//revive:disable-next-line:error-return\nfunc (ta *TLSAuth) checkRevocationPath(ctx context.Context, chain []*x509.Certificate) (error, bool) {\n\t// if we ever fail to check OCSP or CRL, we should not cache the result\n\tcouldCheck := true\n\n\t// starting from the root CA and moving towards the leaf certificate,\n\t// check for revocation of intermediates too\n\tfor i := len(chain) - 1; i > 0; i-- {\n\t\tcert := chain[i-1]\n\t\tissuer := chain[i]\n\n\t\trevokedByOCSP, checkedByOCSP := ta.ocspChecker.isRevokedBy(ctx, cert, issuer)\n\t\tcouldCheck = couldCheck && checkedByOCSP\n\n\t\tif revokedByOCSP && checkedByOCSP {\n\t\t\treturn errors.New(\"certificate revoked by OCSP\"), couldCheck\n\t\t}\n\n\t\trevokedByCRL, checkedByCRL := ta.crlChecker.isRevokedBy(cert, issuer)\n\t\tcouldCheck = couldCheck && checkedByCRL\n\n\t\tif revokedByCRL && checkedByCRL {\n\t\t\treturn errors.New(\"certificate revoked by CRL\"), couldCheck\n\t\t}\n\t}\n\n\treturn nil, couldCheck\n}\n\nfunc (ta *TLSAuth) setAllowedOu(allowedOus []string) error {\n\tuniqueOUs := make(map[string]struct{})\n\n\tfor _, ou := range allowedOus {\n\t\t// disallow empty ou","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/tls_auth.go#L37-L73","documentation":"During TLS client-certificate authentication, checkRevocationPath walks each certificate in the presented chain and asks the OCSP checker whether the cert has been revoked by its issuer. When OCSP confirms the certificate is revoked, authentication is rejected with this error.","triggerScenarios":"ValidateCert -> checkRevocationPath on an mTLS request when ta.ocspChecker.isRevokedBy(ctx, cert, issuer) returns revoked=true and the check actually completed (checked=true).","commonSituations":"A bouncer or LAPI client's certificate was revoked by the CA (e.g. bouncer decommissioned, key compromised) but the client still presents it; OCSP responder is reachable and authoritative.","solutions":["Issue a new client certificate for the client and re-enroll it (cscli bouncers new / users new)","Verify with the CA/OCSP responder why the certificate is revoked","If the revocation is wrong, re-issuance or un-revoking at the CA is required — CrowdSec will not bypass OCSP","Remove the stale certificate from the client's configuration"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client-side preflight: check cert status before presenting\nstatus, err := ocsp.ParseResponseForCert(...) // or query your CA\nif status == ocsp.Revoked { reissueCert() }","typeGuard":null,"tryCatchPattern":"// treat as auth failure, retry with renewed cert only\nif strings.Contains(err.Error(), \"revoked by OCSP\") {\n    reissueAndReenroll()\n}","preventionTips":["Rotate client certificates proactively before revocation/decommission","Revoke and re-issue as a pair: always replace certs on clients you decommission","Monitor OCSP responder availability to distinguish revocation from infra issues"],"tags":["tls","mtls","ocsp","revocation","certificate"],"backgroundTag":"certificate-revoked","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}