This article explains the certificate revocation error that occurs on a Juniper SRX device when attempting to verify a local certificate and the system detects that the certificate has been revoked.

 Running the request security pki local-certificate cer verify certificate-id <certificate-id> command displays the error: local certificate <certificate-id> verification failed. local cert is revoked.

Certificates can be revoked due to expiration, compromise, or intentional revocation by a Certificate Authority (CA). If the certificate is revoked the SRX device fails to establish secure connections that rely on that certificate.

Possible causes:

Certificate Revocation: The certificate in question may have been marked as revoked by the issuing Certificate Authority (CA).

Expiration: The certificate could be expired, resulting in an automatic revocation by policy.

Certificate Compromise: In cases where the private key associated with the certificate is suspected to be compromised, the CA may revoke the certificate.

Solution:

Check with the Certificate Authority to confirm if the certificate <certificate-name> is indeed revoked.  

If using a Certificate Revocation List (CRL), ensure that the SRX device has access to the updated CRL file to verify the status.

After verification, generate a new Certificate Signing Request (CSR) on the SRX device:

request security pki generate-key-pair certificate-id <new-certificate-id> size 2048 type rsa

request security pki local-certificate generate-certificate-request certificate-id <new-certificate-id>

Import the new certificate to the device:

request security pki local-certificate load certificate-id <new-certificate-id> filename <certificate-file>

How to load a PKI x.509 certificate on a J Series or SRX Series device