Firefox reports SEC_ERROR_REVOKED_CERTIFICATE with a GoDaddy certificate and the website doesn't work

Question

My website is not working in Firefox.

Here is the info about drmohanskinandhaircentre.com security certificate which is issued by GoDaddy:

What should I do?

Answer 1

Your certificate has been revoked by the CA that issued it.

If you go to https://www.ssllabs.com/ssltest/analyze.html?d=drmohanskinandhaircentre.com you can see:

Revocation status   Revoked   INSECURE
Trusted     No   NOT TRUSTED (Why?)

with then further details.

Even simpler, go to https://certificate.revocationcheck.com/drmohanskinandhaircentre.com and it clearly shows that GoDaddy OCSP service replies that the certificate is revoked:

http://ocsp.godaddy.com/ (GET)
OCSP response information
Source: OCSP server listed in Certificate
Location: http://ocsp.godaddy.com/
Size: 1801 bytes (DER)
Response time: 46.395892ms
Signature algorithm: SHA256-RSA
Signature type: CA Delegated
Signed by: Go Daddy Validation Authority - G2
Issued by: Go Daddy Secure Certificate Authority - G2
Signing certificate validity: Oct 16, 2018 2:00:00 AM - Oct 16, 2019 2:00:00 AM
Signing certificate algorithm: SHA256-RSA
Reported statuses: 1
This update: Jan 4, 2019 10:40:17 AM
Next update: Jan 5, 2019 10:40:17 PM
Produced at: Jan 4, 2019 10:40:17 AM
Server status: Success
Status: Revoked

You can also browse public Certificate Logs Transparency interface, which yields for example for your certificate at: https://crt.sh/?q=7dd23716842483fe2081303314f039e91f6f0c78ce1eeb98831115e7ae4269a2

We learn there that:

Mechanism           Provider    Status                         Revocation Date  Last Observed in CRL    Last Checked (Error)
OCSP                The CA      Check                              ?    n/a     ?
CRL                 The CA      Revoked (cessationOfOperation)  2018-11-13  05:09:44 UTC    2019-01-04  12:58:31 UTC    2019-01-04  19:46:22 UTC
CRLSet/Blacklist    Google      Not Revoked                     n/a     n/a     n/a
disallowedcert.stl  Microsoft   Not Revoked                     n/a     n/a     n/a
OneCRL              Mozilla     Not Revoked                     n/a     n/a     n/a

So it seems your certificate is revoked since 2018-11-13. And if you search for all certificates on your hostname, at https://crt.sh/?q=drmohanskinandhaircentre.com you find quite a lot of certificates issued in a short timeframe, which is odd.

You need to contact the CA or the provider of this certificate and request another one, since the current one is now useless. If you want, you can also ask why it was revoked, but you may not get an answer and even if you do that will not help solving your problem.

Also note that not all browsers are doing OCSP checks and they might be disabled, broken or filtered out. Hence some browsers may be able to connect to the website just because they are not doing the OCSP check needed to discover the revocation.

As "Don King" commented, you may have less problems in the future by using a certificate generated only for that specific hostname. The current (revoked) one is:

Common names    advcontractors.co.uk
Alternative names   advcontractors.co.uk www.advcontractors.co.uk advshutter.co.uk nrihairtransplantcentre.com ivfcentreinmoga.com sofatinfertility.in drmohanskinandhaircentre.com clinicbychoice.com

With a certificate like that, if there is a problem with any name (like a name changing holders or not being renewed, in which case the CA is required to revoke the certificate per CAB Forum requirements), the whole certificate has to be revoked, so all names in it share fate.