How to Revoke a Certificate and Publish a New CRL
Applies to: Windows Server 2019, 2022 and 2025.
Revocation marks a certificate untrusted before expiry. Clients can act only after a current CRL or OCSP response reaches them.
PKI changes affect trust across the organization. Use an approved certificate policy, offline backups and separation of duties. Visit networkmanager.info.
Prerequisites
- Confirm serial number and reason.
- Validate requestor authority.
- Ensure publication paths are reachable.
- Understand propagation and cache timing.
Procedure
Step 1: Locate certificate
Find the exact entry in Issued Certificates.
Step 2: Revoke
In Certification Authority choose All Tasks, Revoke Certificate and select the accurate reason.
Step 3: Publish CRL
Generate a new CRL when immediate policy requires it.
certutil -crlStep 4: Publish files
Copy CRLs to every configured HTTP or LDAP distribution point.
Step 5: Test retrieval
Validate from a client outside the CA.
Verification
Use URL retrieval to check chain and revocation.
certutil -verify -urlfetch C:\Temp\revoked-certificate.cerRollback and recovery
Revocation is generally not ordinary rollback. Certificates placed on hold may have limited recovery options; otherwise issue a replacement.
Security notes
Revocation is ineffective when distribution points are unreachable or cached CRLs remain valid too long.
Official references
Explore Netcloud24 Canada.
