Certificates can be revoked for a variety of reasons, including:
- The key has been compromised.
- The certification authority (CA) that issued
the certificate has been compromised.
- The certificate is no longer valid for the
intended purpose or has been superseded by another certificate.
- The client no longer qualifies for the
certificate.
You must be a CA administrator or certificate manager to complete this procedure. For more information, see Implement Role-Based Administration.
|
To revoke a certificate |
-
Open the Certification Authority snap-in.
-
In the console tree, click Issued Certificates.
-
In the details pane, click the certificate you want to revoke.
-
On the Action menu, point to All Tasks, and click Revoke Certificate.
-
Select the reason for revoking the certificate, adjust the time of the revocation, if necessary, and then click Yes.
The following reason codes are available:
- Unspecified
- Key Compromise
- CA Compromise
- Change of Affiliation
- Superseded
- Cease of Operation
- Certificate Hold
If you specify "Certificate Hold" as the reason for revoking the certificate, it typically means that you may want to unrevoke the certificate at a future time. Only certificates that have been revoked with the reason of "Certificate Hold" can be unrevoked.
You must be a CA administrator or certificate manager to complete this procedure. For more information, see Implement Role-Based Administration.
|
|
To unrevoke a certificate |
-
Open the Certification Authority snap-in.
-
In the console tree, click Revoked Certificates.
-
In the details pane, click the certificate you want to unrevoke.
-
On the Action menu, point to All Tasks, and click Unrevoke Certificate.
-
Select the reason for unrevoking the certificate, adjust the time of the revocation, if necessary, and then click Yes.
To be meaningful, certificate revocation must be combined with the publication and distribution of certificate revocation data.