| Previous | Next |
| STATUS_FAIL_FAST_EXCEPTION | STATUS_DYNAMIC_CODE_BLOCKED |
STATUS_IMAGE_CERT_REVOKED
The image signer certificate is revoked
A cryptographically correct signature can still be rejected when the signing certificate has been revoked by its issuer. Revocation information is distributed through CRLs or online status services and can indicate key compromise, certificate mis-issuance, supersession, or another reason that the issuer no longer authorizes trust.
The relevant validation time can depend on a trusted timestamp and policy. Reinstalling the same signed binary does not change its certificate chain. The software publisher must provide an image signed under an acceptable certificate or explain a documented policy exception.
What to inspect
- Record the signer chain, serial number, revocation reason, CRL or OCSP source, and trusted timestamp result.
- Confirm system time, proxy access, revocation-cache state, and whether validation used the current time or signing time.
- Verify the result with WinVerifyTrust or SignTool using explicit revocation checks.
- Do not suppress revocation globally; obtain a newly signed vendor release or narrowly documented remediation.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WinVerifyTrust
- Microsoft: SignTool
- IETF RFC 5280: certificate and CRL profile
Looking for a different code? Search another status or error code.