Certificate support
How and When to Revoke an SSL Certificate
Revoke an SSL certificate when its private key is exposed, its details are wrong, or you no longer use the domain. Here is when revocation is required, how to request it, and how quickly browsers notice.
To revoke an SSL certificate, you ask the certificate authority (CA) that issued it to mark it invalid before its expiry date. You do this from your certificate order in your account, and the CA then publishes the revocation in its CRL (certificate revocation list) and, where it still runs one, its OCSP responder (a service that answers “is this certificate still good?”). Revoke when the private key may be exposed, when the certificate contains wrong information, or when you stop using the domain.
| Key fact | Detail |
|---|---|
| Who revokes | The issuing CA – at your request or on its own if rules require it |
| Can it be undone? | No. A revoked certificate stays revoked |
| Replacement | Reissue a new certificate during your plan term |
| How it is published | CRL (required for public CAs) and OCSP (optional for public CAs since CA/Browser Forum ballot SC-063, 2023) |
Need a replacement first?
Reissue the certificate with a new key during your plan term, install it, then revoke the old one.
How to reissue an SSL certificateWhen must you revoke an SSL certificate?
You must request revocation when the private key is compromised or may be, when information in the certificate is wrong, or when you no longer control or use the domain. The CA/Browser Forum Baseline Requirements (section 4.9.1.1) also oblige the CA itself to revoke in these cases once it learns about them.
| Situation | Revoke? | CA deadline under the Baseline Requirements |
|---|---|---|
| Private key leaked, stolen or on a lost/hacked server | Yes, immediately | Within 24 hours |
| You request revocation in writing | – | Within 24 hours |
| Certificate details are wrong (organization name, address) | Yes | Within 5 days |
| Domain sold, expired or no longer under your control | Yes | On your request: within 24 hours |
| Server decommissioned, key securely destroyed | Recommended | On your request: within 24 hours |
| Certificate simply replaced by a renewal | Optional | – |
Tip: If you are unsure whether a key was exposed, treat it as compromised. A reissue with a new key costs you an install; a leaked key can let an attacker impersonate your site until the certificate expires.
How to revoke a certificate
Prepare the replacement
If the site must stay online, reissue the certificate with a newly generated private key and install it first.
Open the order in your account
Select the certificate (check the serial number) and choose the revocation option, or contact support with the order number.
Choose the reason
Pick the reason the CA offers, such as key compromise, superseded or cessation of operation. Key compromise may require proof.
Confirm and verify
Confirm the request, then check that the old certificate is no longer served anywhere – load balancers, CDNs and mail servers included.
How do you request SSL certificate revocation?
You request revocation through the account where you ordered the certificate, which passes the request to the issuing CA. If you cannot access the account, contact our support team with the order number and the certificate’s serial number, and we raise the request with the CA.
Anyone who can prove key compromise – for example by signing a challenge with the leaked key – can also report it directly to the CA. The CA then has to revoke even if the request does not come from you.
Do you get a replacement after revoking?
Revocation itself does not give you a new certificate; a reissue does. During your plan term you can reissue an SSL certificate with a new key and the same validated details, usually without paying again. Do the reissue first so your site never runs without a valid certificate. Some CAs revoke the previous certificate automatically after a reissue, so check your order status. If the certificate has reached the end of its term instead, you need to renew an SSL certificate, not revoke it.
CRL vs OCSP at a glance
CRL
A signed list of revoked serial numbers the CA publishes. Required for public CAs; a new CRL must follow within 24 hours of a revocation. | link:
OCSP responder
A service that answers status queries for one certificate. Optional for public CAs since ballot SC-063; some CAs have switched it off. | link:
Browser lists
Chrome and Firefox push compact revocation lists to the browser instead of asking the CA on every visit. | link:
How fast do browsers notice revocation?
Not instantly, and it depends on the browser. As of October 2026, Chrome does not query OCSP for ordinary certificates; it relies on CRLSets, a curated subset of revocations pushed to the browser. Firefox has used CRLite on desktop since version 137, a compact list of all revocations from public CAs that updates about every 12 hours.
In practice, a revoked certificate can keep working in some clients for hours or longer, and some non-browser clients never check revocation at all. That is why revocation is a safety net, not a substitute for protecting the private key – and why shorter certificate lifetimes matter. For the wider limits of the system, read our guide on how secure SSL is.
After revoking, confirm that your server delivers the new certificate with our online SSL checker tool.
Replace the revoked certificate
Reissue during your plan term with a fresh key and the same validated details.
Reissue your certificate