Revoke certificates
Revoke a certificate
DELETE /api/certificates/{id} revokes the certificate with that id; the response has no body. Once revoked, the certificate's
dateRevoked is filled in.
The client libraries call it with revokeCertificate(certificateId) (Python: revoke_certificate). Neither the API nor the clients
take a revocation reason.
The .NET client calls it with RevokeCertificateAsync(certificateId).
- Revoking needs a role that can delete certificates, such as Worker or Registration Agent (see Application roles).
- Amplia records only the date of the revocation, and the API has no call to undo it.
- Revoking a certificate that is already revoked fails with the error code
CertificateAlreadyRevoked.
TODO(docs): no sample shows revocation through the API.
On the dashboard, users with the Registration Agent role can create certificate orders and revoke certificates, and nothing else.
How revocation is published
- Amplia publishes CRLs on the access domains you choose.
The issued certificate lists them in
info.crlDistributionPoints. - Amplia can answer OCSP requests, and can copy CRLs and CA certificates to external storage.
GET /api/cas/{caId}/crlslists a CA's CRLs, andGET /api/crls/{id}/contentdownloads one.
Revoking doesn't issue a new CRL: each CA issues CRLs on its own schedule, every crlIssuePeriod, each valid for crlIssueValidity
(both fields of the CA). A revocation therefore shows on the CA's next scheduled CRL, within about one crlIssuePeriod. The CRL entries
carry the serial number and the revocation date, with no reason code.
Amplia's OCSP responder reads the revocation from the database, so it reports the certificate as revoked right away, with the reason
unspecified.
Renewal
Amplia can renew certificates, giving the holder a new certificate in place of the one that is expiring.
TODO(docs): no page documents how to renew a certificate, through the API or otherwise.