eclipse-vertx/vert.x · critical · CertificateException

Certificate revoked

Error message

Certificate revoked

What it means

During TLS trust verification, the wrapped X509TrustManager checks each certificate against the configured CRLs (certificate revocation lists); if crl.isRevoked(cert) is true it throws CertificateException("Certificate revoked"), causing the handshake to fail because the peer presented a revoked certificate.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextProvider.java:197

      TrustManager trustMgr = trustMgrs[i];
      if (trustMgr instanceof X509TrustManager) {
        X509TrustManager x509TrustManager = (X509TrustManager) trustMgr;
        trustMgrs[i] = new X509TrustManager() {
          @Override
          public void checkClientTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
            checkRevoked(x509Certificates);
            x509TrustManager.checkClientTrusted(x509Certificates, s);
          }
          @Override
          public void checkServerTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
            checkRevoked(x509Certificates);
            x509TrustManager.checkServerTrusted(x509Certificates, s);
          }
          private void checkRevoked(X509Certificate[] x509Certificates) throws CertificateException {
            for (X509Certificate cert : x509Certificates) {
              for (CRL crl : crls) {
                if (crl.isRevoked(cert)) {
                  throw new CertificateException("Certificate revoked");
                }
              }
            }
          }
          @Override
          public X509Certificate[] getAcceptedIssuers() {
            return x509TrustManager.getAcceptedIssuers();
          }
        };
      }
    }
    return trustMgrs;
  }
}

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Obtain a new certificate from the CA and replace the revoked one on the peer.
2. Update the CRL files (crlPath) to the latest issued by the CA and redeploy.
3. Verify the CRL belongs to the same CA as the cert chain — a mismatched/stale CRL can cause false positives.
4. Remove the revoked certificate from the trusted/allowed material if it was mistakenly pinned.

Example fix

// before
TrustOptions trust = new JksOptions().setPath("trust.jks").setCrlPath("stale.crl");
// after
TrustOptions trust = new JksOptions().setPath("trust.jks").setCrlPath("current-2026.crl");

try { handshake/connect... } catch (SSLHandshakeException e) {
  if (e.getCause() instanceof CertificateException && String.valueOf(e.getCause().getMessage()).contains("revoked")) {
    // rotate certificate / refresh CRL
  }
}

When it happens

Trigger: TLS handshake where the remote peer's certificate (or any cert in its chain) appears in a CRL supplied via TrustOptions.setCrlPath/setCrlValues; invoked from checkClientTrusted or checkServerTrusted.

Common situations: Server certificate revoked by its CA after key compromise or domain ownership change; client mTLS certificate revoked on employee offboarding; stale CRL copied into deployment mistakenly flagging certs.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Class not allowed:
• Class not allowed:
• Accessed denied for chown on ${path}
• Not listening
• ${certificate.getSigAlgName()}

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/f178d229ade6b677. Report an issue: GitHub.