What it is
Revoking a certificate marks it as no longer trustworthy and publishes that fact through CRL and OCSP so relying parties stop accepting it. TigerTrust handles both the internal state update and the downstream propagation automatically.When to use it
- A private key is known or suspected to be compromised.
- An employee leaves and their client certificate should no longer be accepted.
- A certificate was mis-issued (wrong domain, wrong subject) and needs to be replaced.
- A service is being retired and its TLS certificate should no longer be trusted.
Set it up
- From the inventory
- From the Revocation screen
Open a certificate on Certificates, click Revoke, pick a reason from the dropdown, and confirm. The revocation takes effect immediately.
Revocation reasons
| Reason | When to use |
|---|---|
unspecified | No specific reason (default) |
keyCompromise | Private key exposed or suspected exposed |
caCompromise | The issuing CA itself was compromised |
affiliationChanged | Subject organization changed |
superseded | Replaced by a newer certificate |
cessationOfOperation | Service or entity retired |
certificateHold | Temporary suspension — can be lifted |
privilegeWithdrawn | Subject no longer entitled |
certificateHold is the only reversible reason. All others are terminal — you would have to issue a fresh certificate to restore trust.What happens next
Mark the certificate revoked
The platform updates the certificate’s status to
revoked and writes an audit log entry with the reason and the requesting user.Notify the CA (internal CAs)
For certificates issued by your internal PKI, the revocation is recorded in the CA’s revocation store and the CRL cache is invalidated immediately.
Vendor API (external CAs)
For supported external CAs (DigiCert, Sectigo, GoDaddy, Entrust, AWS Private CA, HashiCorp Vault), TigerTrust calls the vendor’s revoke API with the same reason code.
Regenerate CRL
The CRL is regenerated and published. For high-value CAs you can configure immediate regeneration on any revocation; otherwise it follows the CA’s normal schedule.
Propagation timing
| Component | Update latency |
|---|---|
| TigerTrust inventory | Immediate |
| Internal CA revocation store | Immediate |
| CRL fetched by clients | Bounded by nextUpdate on the previous CRL (default 7 days; tune down for high-value CAs) |
| OCSP responses | Immediate (no server-side cache); client cache respects the response’s nextUpdate |
| External vendor CA status | Vendor-dependent — minutes to hours |
Related
CRL & OCSP
Distribution point details, OCSP stapling, and performance tuning.
PKI Core
Internal CA operations that back revocation for private PKI.
Audit logs
Every revocation is recorded with user, timestamp, and reason.