---
title: "Revoke certificates"
description: "How to revoke a certificate issued by Amplia through the API, how revocation reaches CRLs and OCSP, and what the sources say about renewal."
canonical: "https://docs.lacunasoftware.com/en-us/articles/amplia/integration/revocation"
locale: "en"
product: "Amplia"
last_updated: "2026-10-12"
---

# Revoke certificates

## Revoke a certificate

`DELETE /api/certificates/{id}` revokes the certificate with that id; the response has no body. Once revoked, the certificate's
`dateRevoked` is filled in. 

The client libraries call it with `revokeCertificate(certificateId)` (Python: `revoke_certificate`). Neither the API nor the clients
take a revocation reason. 
The .NET client calls it with `RevokeCertificateAsync(certificateId)`. 

* Revoking needs a role that can delete certificates, such as **Worker** or **Registration Agent** (see [Application roles](https://docs.lacunasoftware.com/en-us/articles/amplia/integration#api-key)). 
* Amplia records only the date of the revocation, and the API has no call to undo it. 
* Revoking a certificate that is already revoked fails with the error code `CertificateAlreadyRevoked`. 

TODO(docs): no sample shows revocation through the API.

On the dashboard, users with the *Registration Agent* role can create certificate orders and revoke certificates, and nothing else. 

## How revocation is published

* Amplia publishes CRLs on the [access domains](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises#access-domains) you choose. 
  The issued certificate lists them in `info.crlDistributionPoints`. 
* Amplia can answer [OCSP](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-ocsp) requests, and can [copy CRLs and CA certificates](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/crl-propagation)
  to external storage. 
* `GET /api/cas/{caId}/crls` lists a CA's CRLs, and `GET /api/crls/{id}/content` downloads one. 

Revoking doesn't issue a new CRL: each CA issues CRLs on its own schedule, every `crlIssuePeriod`, each valid for `crlIssueValidity`
(both fields of the CA). A revocation therefore shows on the CA's next scheduled CRL, within about one `crlIssuePeriod`. The CRL entries
carry the serial number and the revocation date, with no reason code. 

Amplia's OCSP responder reads the revocation from the database, so it reports the certificate as revoked right away, with the reason
`unspecified`. 

## Renewal

Amplia can renew certificates, giving the holder a new certificate in place of the one that is expiring. 

TODO(docs): no page documents how to renew a certificate, through the API or otherwise.

## See also

* [Errors](https://docs.lacunasoftware.com/en-us/articles/amplia/integration/errors)
* [Configure OCSP](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/configure-ocsp)
* [CRL propagation](https://docs.lacunasoftware.com/en-us/articles/amplia/on-premises/crl-propagation)