About CA revocation
Revoke an intermediate CA in DigiCert® Private CA when its key or certificate is compromised, when it is superseded, when operations cease, or for another supported reason that requires CRL and OCSP to report it as revoked.
What revocation does
Nothing changes until the approver approves the request. After approval:
The CA status changes to Revoked. A revoked CA cannot issue certificates, generate CRLs, or create OCSP responders, and application-level functions can no longer act on it.
Revocation data is updated. The CA certificate is added to the CRL of its issuing CA when that CRL is next generated, and OCSP is updated immediately.
Certificates the CA already issued are not revoked automatically. For a non-qualified intermediate CA, child CAs and end-entity certificates stay as they are until you revoke them separately. Relying parties that check revocation status will no longer trust certificates whose chain includes the revoked CA.
The action is audited. The revocation request and the approval are recorded in the audit logs.
Qualified intermediate CAs
For intermediate CAs that issue ETSI Qualified certificates in self-hosted environments, approving a revocation also revokes all child CAs and end-entity certificates (reason: 0, unspecified), publishes a final CRL with a next update value of 99991231235959Z, and then revokes the requested CA. This cannot be undone, and a revoked Qualified ICA cannot be reinstated.
Revocation reasons
Reason | Private intermediate CA | Qualified intermediate CA |
|---|---|---|
Unspecified | Yes | Yes |
Key compromise | Yes | Yes |
Affiliation changed | Yes | No |
Superseded | Yes | Yes |
Cessation of operation | Yes | Yes |
Certificate hold (can be reinstated) | Yes | No |
Privilege withdrawn | Yes | Yes |
Restrictions
Root CAs cannot be revoked in DigiCert Private CA.
A disabled CA cannot normally be revoked until it is active again. The exception is the offline or external CA synchronization scenario.
An expired CA cannot be revoked if the requested revocation date is after the certificate expiration date.
An earlier, disabled generation of a recertified CA cannot be revoked on its own while a later generation is still valid.
Revocation and recertified CAs
If you revoke an active CA that was recertified or replaced, all earlier generations in its lineage are revoked too. The CRL includes them, with revocation dates close to that of the active CA.
To submit a revocation request, see Revoke an intermediate CA.