# What Is Certificate Revocation (Revocation)?

> Certificate revocation is a CA's act of declaring an unexpired certificate invalid, published through CRLs or OCSP so that clients stop trusting it.

Source: https://ssl.sh/glossary/revocation/
Last updated: 2026-11-10

Certificate revocation is how a CA declares a certificate invalid before its validity period ends. The CA records the serial number and a reason, then publishes the new status through a [CRL](https://ssl.sh/glossary/crl/) and, optionally, [OCSP](https://ssl.sh/glossary/ocsp/). Common reasons are a compromised private key, a certificate issued in error, or the subscriber no longer controlling the domain.

## Why it matters
The CA/Browser Forum Baseline Requirements set deadlines: for example, 24 hours for a confirmed key compromise and 5 days for many other reasons, including most misissuance. But revocation only protects users if clients notice it, and in practice checking has been weak: live OCSP is usually soft-fail and leaks privacy, so browsers rely on pushed lists such as Chrome's CRLSets and Firefox's [CRLite](https://ssl.sh/glossary/crlite/). This weakness is a major reason the industry is shortening certificate lifetimes. Under Ballot SC-081v3, maximum validity falls to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, so a compromised certificate ages out quickly even when revocation is missed.

## Example
Revoke a Let's Encrypt certificate whose key leaked, using Certbot:

```bash
sudo certbot revoke \
  --cert-path /etc/letsencrypt/live/example.com/cert.pem \
  --reason keycompromise
```

Then issue a replacement with a new private key; revoking alone leaves the site serving an invalid certificate.

## Common misconceptions
- **Deleting the certificate file is the same as revoking it.** Anyone holding a copy of the key can still use the certificate; only revocation tells clients to distrust it.
- **Revocation takes effect instantly everywhere.** It appears with the next CRL, OCSP update or browser list push, and some clients never check at all.
- **You can keep the old private key after revoking.** If the reason was key compromise, generate a new key; CAs are required to reject keys known to be compromised.

## Related terms

- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [OCSP Stapling](https://ssl.sh/zh/glossary/ocsp-stapling/): OCSP Stapling 是 TLS 服务器把 CA 签名、带有效期的 OCSP 响应随握手一起发给客户端的机制，浏览器因此不必再自己去问 CA。
- [CRLite](https://ssl.sh/zh/glossary/crlite/): CRLite 是 Mozilla 为 Firefox 打造的压缩吊销数据集，浏览器无需联系 CA，就能在本地判断公开记录的证书是否已被吊销。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [错误签发](https://ssl.sh/zh/glossary/misissuance/): 错误签发是指 CA 违反 Baseline Requirements 或根证书计划政策签发证书，从验证缺陷到字段格式错误都算在内。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。