STATUS_IMAGE_CERT_REVOKED (0xC0000603) – File Signature Revoked

What causes this error and how to spot it

You see STATUS_IMAGE_CERT_REVOKED (0xC0000603) when Windows tries to load a file – usually a driver or an executable installer – and the digital certificate used to sign it has been revoked by the certificate authority. This isn't the same as an expired certificate. Revoked means the CA flagged that cert as compromised or no longer trustworthy.

You'll see this error in a few places:

• A blue screen with the stop code 0xC0000603 during boot.
• A pop-up saying "Windows cannot verify the digital signature for this file" when you try to install software.
• The Event Viewer logs under System, source BugCheck or Microsoft-Windows-Kernel-General.

Real-world trigger: You install a new graphics card driver from a third-party site, or you download a tool like CPU-Z from an old mirror. The cert got revoked, and now Windows won't touch it.

Fix 1: Update the certificate revocation list (CRL) and root certificates

Windows checks a local cached list of revoked certificates. If that list is outdated, it might flag a valid file as revoked, or miss the revocation. But more often, the issue is that your PC hasn't downloaded the latest CRL from the CA. This is the most common fix and takes two minutes.

1. Press Windows + R, type wuauclt.exe /detectnow and hit Enter. This forces Windows Update to check for updates, which includes updated CRLs.
2. Wait 30 seconds. Then open PowerShell as Administrator (right-click Start, choose Windows Terminal (Admin)).
3. Run this command to manually update root certificates:
   

   certutil -generateSSTFromWU roots.sst
   certutil -addstore Root roots.sst

   This downloads the latest trusted root certs from Windows Update and imports them. After the second command, you should see "The store was opened successfully."
4. Restart your PC. Try opening the file that gave the error again.

What to expect: After the restart, the same file should either load without error or at least give a different error (like "publisher unknown"). If it still says revoked, move to Fix 2.

Fix 2: Temporarily disable driver signature enforcement for a single boot

If the file is a driver that you absolutely need to install and you trust the source (e.g., an older printer driver from the manufacturer's official site), you can bypass the revoked check once. This is not a permanent solution – it's a band-aid so you can install the driver, then you should update the driver afterward.

Warning: Disabling signature enforcement opens your PC to unsigned malware. Only do this if you know the file is legit.

1. Open Settings > Update & Security > Recovery (Windows 10) or Settings > System > Recovery (Windows 11).
2. Under Advanced startup, click "Restart now."
3. Your PC reboots into a blue menu. Click Troubleshoot > Advanced options > Startup Settings > Restart.
4. After the restart, you'll see a list of options. Press 7 to select "Disable driver signature enforcement."
5. Windows boots normally, but now it won't check signatures. Install your driver or run the file.
6. Reboot again normally. The enforcement is re-enabled automatically.

What to expect: During that single boot, the file runs. If it still gives the revoked error, the revocation check is embedded in the file itself, which is rare. In that case, you need to get a newer version of the file.

Fix 3: Use BCDEdit to permanently disable signature verification (only for testing)

This is the nuclear option. I only recommend it if you're a developer testing unsigned drivers or you have a legacy app that must run and you can't update it. It disables the Kernel-Mode Code Signing check entirely.

1. Open Command Prompt as Administrator (right-click Start, Command Prompt (Admin)).
2. Type this command and press Enter:
   

   bcdedit.exe -set loadoptions DISABLE_INTEGRITY_CHECKS
   bcdedit.exe -set TESTSIGNING ON

3. Reboot. You'll see a watermark in the bottom-right corner saying "Test Mode."
4. Your driver should now load. But know this: every time you boot, the system is less secure. Malware can load unsigned rootkits.
5. To undo it, run the same commands with OFF instead of ON and remove the loadoptions:
   

   bcdedit.exe -set loadoptions ENABLE_INTEGRITY_CHECKS
   bcdedit.exe -set TESTSIGNING OFF

   Then reboot.

What to expect: The error should vanish entirely while Test Mode is active. If it doesn't, the file is corrupted or the revocation is hard-coded in the file's digital signature (rare, but happens with some old signed malware).

Quick-reference summary table

The real fix is almost always Fix 1. If you keep seeing 0xC0000603 after updating root certs, you're dealing with a file that's genuinely been revoked – get a fresh copy from the publisher. Don't work around a revoked cert unless you're absolutely sure the file is safe.