Reinstate or unrevoke a CA
Reinstate (unrevoke) an intermediate CA in DigiCert® Private CA to return it to service. Only a non-qualified intermediate CA that was revoked with the reason Certificate hold can be reinstated. For every other revocation reason the revocation is permanent and the Reinstate CA option is unavailable. A revoked Qualified intermediate CA cannot be reinstated.
Before you begin
You need a second administrator who has CA manager permission to approve the request.
To reinstate a CA
In the left main menu, under Manage CAs, select Intermediates, and then select the revoked intermediate CA.
On the CA details page, select More actions (three dots) > Reinstate CA.
Select a different administrator to approve the request.
Enter a comment or reason, and then submit the request. The CA remains revoked while the request is pending.
The approver reviews the request and approves or rejects it.
If the approver approves: The CA returns to Active, can issue certificates, and resumes signing OCSP responses and CRLs. OCSP and CRL records are updated, and the CA is removed from the issuer CRL when the next CRL is generated.
If the approver rejects: The CA remains revoked.
Verify the result
After approval, the CA status is Active, issuance resumes, and CRL and OCSP records are updated. The approval or rejection appears in the audit logs.
Reinstate an intermediate CA under an offline root
When an intermediate CA under an offline root is revoked, the UI may not show the Reinstate CA option. Instead, import a newer CRL from the offline root that no longer lists the intermediate CA. This works only if the intermediate CA was on hold and has not expired.
Anmerkung
After you import the updated CRL, the ICA is Disabled, not Active. An administrator must enable it manually before it can resume operation. See Enable a CA.