Filtering by: Certificate Revocation List x clear
compliance

CertCentral: Revocation reasons for revoking certificates

CertCentral supports including a revocation reason when revoking a certificate. Now, you can choose one of the revocation reasons listed below when revoking all certificates on an order or when revoking an individual certificate by ID or serial number.

Supported revocation reasons:

  • Key compromise* - My certificate's private key was lost, stolen, or otherwise compromised.
  • Cessation of operation - I no longer use or control the domain or email address associated with the certificate or no longer use the certificate.
  • Affiliation change - The name or any other information regarding my organization changed.
  • Superseded - I have requested a new certificate to replace this one.
  • Unspecified - None of the reasons above apply.

*Note: Selecting Key compromise does not block using the associated public key in future certificate requests. To add the public key to the blocklist and revoke all certificates with the same key, visit problemreport.digicert.com and prove possession of the key.

Revoke immediately

We also added the Revoke this certificate immediately option that allows Administrators to skip the Request and Approval process and revoke the certificate immediately. When this option is deselected, the revocation request appears on the Requests page, where an Administrator must review and approve it before it is revoked.

Background

The Mozilla root policy requires Certificate Authorities (CAs) to include a process for specifying a revocation reason when revoking TLS/SSL certificates. The reason appears in the Certificate Revocation List (CRL). The CRL is a list of revoked digital certificates. Only the issuing CA can revoke the certificate and add it to the CRL.