crowdsecurity/crowdsec · critical

certificate revoked by OCSP

Error message

certificate revoked by OCSP

What it means

During TLS client-certificate authentication, checkRevocationPath walks each certificate in the presented chain and asks the OCSP checker whether the cert has been revoked by its issuer. When OCSP confirms the certificate is revoked, authentication is rejected with this error.

Source

Thrown at pkg/apiserver/middlewares/v1/tls_auth.go:55

}

// checkRevocationPath checks a single chain against OCSP and CRL
//revive:disable-next-line:error-return
func (ta *TLSAuth) checkRevocationPath(ctx context.Context, chain []*x509.Certificate) (error, bool) {
	// if we ever fail to check OCSP or CRL, we should not cache the result
	couldCheck := true

	// starting from the root CA and moving towards the leaf certificate,
	// check for revocation of intermediates too
	for i := len(chain) - 1; i > 0; i-- {
		cert := chain[i-1]
		issuer := chain[i]

		revokedByOCSP, checkedByOCSP := ta.ocspChecker.isRevokedBy(ctx, cert, issuer)
		couldCheck = couldCheck && checkedByOCSP

		if revokedByOCSP && checkedByOCSP {
			return errors.New("certificate revoked by OCSP"), couldCheck
		}

		revokedByCRL, checkedByCRL := ta.crlChecker.isRevokedBy(cert, issuer)
		couldCheck = couldCheck && checkedByCRL

		if revokedByCRL && checkedByCRL {
			return errors.New("certificate revoked by CRL"), couldCheck
		}
	}

	return nil, couldCheck
}

func (ta *TLSAuth) setAllowedOu(allowedOus []string) error {
	uniqueOUs := make(map[string]struct{})

	for _, ou := range allowedOus {
		// disallow empty ou

View on GitHub (pinned to 909b515798)

Solutions

1. Issue a new client certificate for the client and re-enroll it (cscli bouncers new / users new)
2. Verify with the CA/OCSP responder why the certificate is revoked
3. If the revocation is wrong, re-issuance or un-revoking at the CA is required — CrowdSec will not bypass OCSP
4. Remove the stale certificate from the client's configuration

// client-side preflight: check cert status before presenting
status, err := ocsp.ParseResponseForCert(...) // or query your CA
if status == ocsp.Revoked { reissueCert() }

// treat as auth failure, retry with renewed cert only
if strings.Contains(err.Error(), "revoked by OCSP") {
    reissueAndReenroll()
}

When it happens

Trigger: ValidateCert -> checkRevocationPath on an mTLS request when ta.ocspChecker.isRevokedBy(ctx, cert, issuer) returns revoked=true and the check actually completed (checked=true).

Common situations: A bouncer or LAPI client's certificate was revoked by the CA (e.g. bouncer decommissioned, key compromised) but the client still presents it; OCSP responder is reachable and authoritative.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• certificate revoked by CRL
• no certificate in request
• no verified cert in request
• client certificate is expired
• tls authentication required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f24cac02f2a3301d. Report an issue: GitHub.