Request Revocation of Your SSL Certificate

This page is for customers who need an SSL Certificate they hold to be revoked. Revocation permanently invalidates an SSL Certificate before its scheduled expiry, so it is important to understand what happens before you request one. When you are ready, the request form is at the bottom of this page.

A revocation request is reviewed by our team before any action is taken. We action revocations manually, so that the request and the circumstances can be confirmed before the SSL Certificate is revoked.

What Revocation Means

Revocation is the permanent invalidation of an SSL Certificate before the date it was due to expire. The Certificate Authority (CA) adds the SSL Certificate to its Certificate Revocation List (CRL), which web browsers and other software check when they establish a secure connection.

Warning : Revocation cannot be undone. A revoked SSL Certificate is permanently listed on the Certificate Revocation List (CRL) and can never be returned to service. Only request revocation once you are certain.

Once an SSL Certificate has been revoked, it cannot be reinstated. The only way to secure the site again is with a replacement SSL Certificate.

The Effect on an SSL Certificate in Use

If the SSL Certificate is still installed on a live website or service, revoking it will disrupt that service. Once the revocation appears on the Certificate Revocation List (CRL), browsers and other software will treat the connection as untrusted, show security warnings to your visitors, and in many cases refuse to connect.

The impact is not limited to that immediate disruption. While a site is unreachable or shows security warnings, its reputation suffers, search engines may penalize it, and it can lose its place in search results. Regaining that position and being re-indexed can take a considerable amount of time.

Important : Do not request revocation for an SSL Certificate that is protecting a live service unless you already have a replacement in place, or the SSL Certificate must be revoked for security reasons. Your visitors will see security warnings as soon as the revocation takes effect.

Where the SSL Certificate has already been replaced, or is no longer in use, revocation will not affect any live service.

When to Request a Revocation

A revocation is usually requested when the Private Key has been exposed or compromised, when the SSL Certificate is no longer needed, when the site or service has been decommissioned, or when you are replacing the SSL Certificate and want the previous one invalidated.

Where a Private Key is known or suspected to have been compromised, revocation is treated as urgent. Industry rules require the Certificate Authority (CA) to revoke an SSL Certificate within twenty-four hours of a confirmed Private Key compromise, so please tell us if this applies to your request.

Revocation Without a Request

An SSL Certificate can also be revoked without a request from you. If the Certificate Authority (CA) is notified that a Private Key has been compromised, it will act on that information, and it also operates its own monitoring and investigation systems that detect many forms of compromise.

A frequent cause of compromise is creating the Certificate Signing Request (CSR) and Private Key with public or untrustworthy tools from sources that are not reputable, which can expose the Private Key from the outset.

Where this happens, the Certificate Authority (CA) usually notifies the person recorded as responsible for the SSL Certificate, using the details provided when it was ordered. The right course of action is then to reissue as soon as possible, so that a new SSL Certificate with a new Private Key replaces the one that was revoked.

Keeping the Private Key safe, and actively monitoring how the SSL Certificate is installed and used, is an ongoing obligation for every customer. Learn About Your Responsibilities 🔗

Obtaining a Replacement

If your license is still valid, a reissue is generally available through the tracking system, which produces a new SSL Certificate using your existing license at no additional cost. Learn About Reissuing Your SSL Certificate 🔗

In some cases, depending on the circumstances of the revocation, a member of our team will assist with issuing a replacement using the remaining validity of your license. Learn About The Trustico® Tracking System 🔗

If your SSL Certificate has already been revoked without a request from you, a separate page explains how to restore your website security. Find Out More About Restoring a Revoked SSL Certificate 🔗

Revocation and Refunds

The ability to revoke an SSL Certificate is a feature of your license, not a means of obtaining a refund. An SSL Certificate is a paid service whose cost is covered by the license, and revoking one does not change what has been paid. Revocation never results in a refund.

Submitting Your Request

When you are ready, complete the revocation request form below with the details of the SSL Certificate and the reason for your request. Each request is then assessed, and the appropriate action is taken in light of the circumstances.

Most Popular Questions

Frequently asked questions covering what SSL Certificate revocation means, its effect on an SSL Certificate in use, the reasons to request one, how a request is handled, revocation initiated by the Certificate Authority, whether revocation results in a refund, and obtaining a replacement

Revocation Explained

Revocation is the permanent invalidation of an SSL Certificate before its scheduled expiry. The Certificate Authority (CA) adds the SSL Certificate to its Certificate Revocation List (CRL), which browsers and other software check when establishing a secure connection. Once revoked, an SSL Certificate cannot be reinstated.

The Effect on an SSL Certificate in Use

If a revoked SSL Certificate is still installed on a live website or service, visitors will see security warnings and many connections will fail once the revocation is published to the Certificate Revocation List (CRL). It can also harm the reputation of the site and its standing in search results. Only request revocation for an SSL Certificate you have already replaced, that is no longer in use, or that must be revoked for security reasons.

Reasons to Request a Revocation

A revocation is usually requested when the Private Key has been exposed or compromised, when the SSL Certificate is no longer needed, or when the site or service has been decommissioned. Where a Private Key is compromised, revocation is urgent, and industry rules require the Certificate Authority (CA) to revoke the SSL Certificate within twenty-four hours.

Revocation Without a Request

An SSL Certificate can be revoked without a request from you if the Certificate Authority (CA) is notified of a Private Key compromise or detects one through its own monitoring. A frequent cause is creating the Certificate Signing Request (CSR) and Private Key with public or untrustworthy tools. The Certificate Authority (CA) usually notifies the recorded contact, and the right response is to reissue as soon as possible.

Handling of Your Request

Your request is submitted through the form on this page. We action revocations manually, so that each request and its circumstances are assessed before the SSL Certificate is revoked. We then take the appropriate action.

Obtaining a Replacement SSL Certificate

If your license is still valid, a reissue is generally available through the tracking system and produces a new SSL Certificate using your existing license at no additional cost. In some cases, depending on the circumstances of the revocation, a member of our team will assist with issuing a replacement using the remaining validity of your license.

Revocation and Refunds

The ability to revoke an SSL Certificate is a feature of your license and is not a means of obtaining a refund. An SSL Certificate is a paid service whose cost is covered by the license, so revocation never results in a refund.