Revoke a certificate

A system certificate must stop being valid now, for example because its key is compromised or the system is being retired.

A revocation order names the issuing CA, the serial number, and the reason. The CA worker records the revocation in the ledger and immediately produces a new CRL, which reaches distribution over two paths. If the database or the management interface is unavailable, an authorized person revokes at the console of the worker host.

Through management

1. Sign in with a role that has revocation rights in the tenant.
2. File the revocation order with the issuing CA, serial number, and revocation reason. Valid reasons are the identifiers from RFC 5280 Section 5.3.1, except removeFromCRL.
3. The worker checks that the certificate is in the ledger and belongs to the CA and tenant, records the revocation, and produces the new CRL with the next CRL number.

By the holder through a protocol

1. Send the revocation order through the protocol with proof of the certificate's key. The worker verifies it against the key in the ledger.

Without database and management (emergency revocation)

1. Get physical or secured remote access to the worker host.
2. Revoke at the console. The revocation order goes straight into the ledger; the new CRL reaches distribution over the second path.

Result. The revocation takes effect at the time of the ledger entry. Relying parties learn about it the next time they load the CRL, by default within 6 hours.

• A revocation is final; there's no way to release it later.
• Repeating a revocation order changes nothing. A revocation order for a certificate that hasn't been issued yet waits or expires.
• A CA is never revoked this way, only in a ceremony at the root; see Respond to a compromised CA key.
• Rehearse emergency revocation: the “database outage” emergency test covers it at least once a year.
• If a partner should get no connection at all anymore, revoke the relationship. Certificate revocation concerns a single certificate.

• PKI and certificate lifecycle – revocation rules and status distribution
• Operations and emergencies – emergency revocation and emergency tests
• Connections to a partner end suddenly