---
title: "Revocation"
description: "CRLs and OCSP for private CAs, and revoking certificates and subordinate CAs."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revocation

Every certificate a private CA issues carries where to check whether it's revoked:

| URL | Content |
| --- | --- |
| `http://pki.ezghcloud.com/crl/<CA ID>.crl` | The CA's full certificate revocation list, DER |
| `http://pki.ezghcloud.com/ocsp/<CA ID>` | OCSP (RFC 6960, GET and POST), answered for the CA's certificates |
| `http://pki.ezghcloud.com/ca/<CA ID>.crt` | The CA's certificate, DER |

They're plain HTTP, as relying parties expect, and served with no credential. The CA's
**Revocation** tab in the console shows them, with when its latest CRL was signed.

## Timing

- **CRLs** are re-signed every 24 hours, with a `nextUpdate` 7 days later (never past the CA's
  own expiry), and within 5 minutes of a revocation.
- **OCSP** responses are signed in advance by the CA's own responder certificate, valid for 4
  days, re-signed daily and within 60 seconds of a revocation. Requests use SHA-1 certificate IDs
  (OpenSSL's default); nonces are ignored.
- A deleted CA's CRL and OCSP keep being served until its certificate expires, so certificates it
  issued can still be checked.

## Check a certificate

```sh
openssl ocsp -issuer corp-issuing.pem -cert api.pem -CAfile chain.pem -no_nonce \
  -url http://pki.ezghcloud.com/ocsp/<CA ID>
curl -s http://pki.ezghcloud.com/crl/<CA ID>.crl | openssl crl -inform DER -noout -text
```

`chain.pem` is the issuing CA's certificate and the root's.

## Revoke

- **A certificate:** `ezgh private-ca certificate revoke <ID> --reason keyCompromise`, the
  certificate's **Revoke** in the console, or
  [RevokePrivateCertificate](/certificates-api/RevokePrivateCertificate/). Reasons are
  `unspecified`, `keyCompromise`, `affiliationChanged`, `superseded` and `cessationOfOperation`.
- **A subordinate CA** is revoked through its parent, which needs
  `certificates.certificateAuthorities.revoke`: `ezgh private-ca ca revoke <CA> --reason superseded`,
  the CA's **Revocation** tab, or
  [RevokeCertificateAuthority](/certificates-api/RevokeCertificateAuthority/). The parent
  lists it on its CRL and OCSP and it's disabled for good, so clients that check reject everything
  under it. An external subordinate is revoked by your own root.
- **A root** isn't revoked: disable or delete it, and remove it from the trust stores it's in.

Revocation can't be undone.

Source: https://docs.ezghcloud.com/private-ca/revocation/index.mdx