Disable a CA
Disable a CA to turn off its services without revoking it or waiting for it to expire, for example during an investigation or a planned maintenance window. A disabled CA stops issuing certificates, and CRL generation and OCSP activity stop with it. Attempts to issue from a disabled intermediate CA fail because the CA is not active. You can re-enable the CA later if it is still eligible.
Achtung
Disabling is not revocation. The CA certificate remains valid to relying parties. If the CA or its key is compromised, Revoke an intermediate CA instead.
To disable a CA:
In the left main menu, under Manage CAs, select Roots or Intermediates, and then select the CA.
On the CA details page, select More actions (three dots) > Disable CA.
Verify the result
The CA status is Disabled, and attempts to issue from the CA fail. The action is recorded in the audit log as Disable root or Disable intermediate CA.