Certificate Revocation (Revocation)

Certificate revocation is how a CA declares a certificate invalid before its validity period ends. The CA records the serial number and a reason, then publishes the new status through a CRL and, optionally, OCSP. Common reasons are a compromised private key, a certificate issued in error, or the subscriber no longer controlling the domain.

Why it matters

The CA/Browser Forum Baseline Requirements set deadlines: for example, 24 hours for a confirmed key compromise and 5 days for many other reasons, including most misissuance. But revocation only protects users if clients notice it, and in practice checking has been weak: live OCSP is usually soft-fail and leaks privacy, so browsers rely on pushed lists such as Chrome's CRLSets and Firefox's CRLite. This weakness is a major reason the industry is shortening certificate lifetimes. Under Ballot SC-081v3, maximum validity falls to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, so a compromised certificate ages out quickly even when revocation is missed.

Example

Revoke a Let's Encrypt certificate whose key leaked, using Certbot:

sudo certbot revoke \
  --cert-path /etc/letsencrypt/live/example.com/cert.pem \
  --reason keycompromise

Then issue a replacement with a new private key; revoking alone leaves the site serving an invalid certificate.

Common misconceptions

• Deleting the certificate file is the same as revoking it. Anyone holding a copy of the key can still use the certificate; only revocation tells clients to distrust it.
• Revocation takes effect instantly everywhere. It appears with the next CRL, OCSP update or browser list push, and some clients never check at all.
• You can keep the old private key after revoking. If the reason was key compromise, generate a new key; CAs are required to reject keys known to be compromised.