When a certificate must be invalidated.
WHEN TO REVOKE
The private key has been exposed A certificate was issued incorrectly The domain has changed hands A certificate was issued fraudulently for your domain
HOW
For a purchased certificate, request revocation through the issuing authority. They publish the revocation so browsers can check.
For AutoSSL certificates, running AutoSSL after correcting the underlying problem issues a fresh certificate. Contact us if you need a specific certificate revoked.
WHAT REVOCATION ACHIEVES
Browsers checking revocation status will reject the certificate. In practice revocation checking is inconsistent across browsers, so revocation is a useful step but not an instant kill switch.
THE MORE IMPORTANT STEP
If a private key was exposed, generate an entirely new key and certificate. Revoking without replacing the key leaves the exposure in place.
REISSUING
Generate a new CSR, which creates a new private key, and obtain a new certificate against it. Do not reuse the compromised key.
IF YOU SUSPECT MISISSUANCE
Search certificate transparency logs for your domain. Unexpected entries warrant investigation.
