Revoke an intermediate CA
Revoke an intermediate CA in DigiCert® Private CA to report it as no longer trusted. One administrator submits the request and a second administrator approves it. To learnwhat revocation does and which reasons are available, see About CA revocation.
Important
Revocation is permanent for every reason except Certificate hold. Confirm the reason before you submit the request.
Before you begin
You need two users who each have one of these roles: CA Admin, CA Operations, PKI Operations, or PKI Manager.
To revoke an intermediate CA
From the left main menu in DigiCert Private CA, select Manage CAs > Intermediates.
Select the active intermediate CA you want to revoke.
In the Details section, select More actions (three dots) > Revoke CA.
On the Revoke CA dialog box:
Select the Approver for the revocation request.
Enter Revocation date.
Enter Reason for the revocation. Certificate hold appears only for CAs that support it.
Enter any relevant notes for the approver.
Select Request to revoke CA.
The approver receives an email with a link to an approval screen, where they approve or reject the request.
If the approver approves the request, the CA status changes to Revoked.
If the approver rejects the request, the CA is unchanged. Start a new request if you still need to revoke it.
Verify the result
The CA status shows Revoked and issuance from the CA fails. The CRL and OCSP reflect the revocation, and the request and approval appear in the audit logs.