Revocation

Every certificate a private CA issues carries where to check whether it’s revoked:

They’re plain HTTP, as relying parties expect, and served with no credential. The CA’s Revocation tab in the console shows them, with when its latest CRL was signed.

Timing

• CRLs are re-signed every 24 hours, with a nextUpdate 7 days later (never past the CA’s own expiry), and within 5 minutes of a revocation.
• OCSP responses are signed in advance by the CA’s own responder certificate, valid for 4 days, re-signed daily and within 60 seconds of a revocation. Requests use SHA-1 certificate IDs (OpenSSL’s default); nonces are ignored.
• A deleted CA’s CRL and OCSP keep being served until its certificate expires, so certificates it issued can still be checked.

Check a certificate

openssl ocsp -issuer corp-issuing.pem -cert api.pem -CAfile chain.pem -no_nonce \
  -url http://pki.ezghcloud.com/ocsp/<CA ID>
curl -s http://pki.ezghcloud.com/crl/<CA ID>.crl | openssl crl -inform DER -noout -text

chain.pem is the issuing CA’s certificate and the root’s.

Revoke

• A certificate: ezgh private-ca certificate revoke <ID> --reason keyCompromise, the certificate’s Revoke in the console, or RevokePrivateCertificate. Reasons are unspecified, keyCompromise, affiliationChanged, superseded and cessationOfOperation.
• A subordinate CA is revoked through its parent, which needs certificates.certificateAuthorities.revoke: ezgh private-ca ca revoke <CA> --reason superseded, the CA’s Revocation tab, or RevokeCertificateAuthority. The parent lists it on its CRL and OCSP and it’s disabled for good, so clients that check reject everything under it. An external subordinate is revoked by your own root.
• A root isn’t revoked: disable or delete it, and remove it from the trust stores it’s in.

Revocation can’t be undone.