Revoking a certificate in Skyrsoft CertOps does three things at once: it flips the certificate’s own status, it adds the serial to the relevant CA’s CRL, and it updates that CA’s OCSP responses — all from the same action, with an RFC 5280 reason code and a comment recorded against it. A certificate can also be suspended rather than revoked outright, which places a temporary certificateHold that can later be lifted, for the case where the situation might resolve rather than being final.
How it works
Both revocation mechanisms are served anonymously, because revocation status is meant to be checked by anything that holds the certificate, not only by an authenticated console user.
| Method | Path | Notes |
|---|---|---|
| CRL | GET /crl/{caId}/full.crl |
Per-CA full CRL — the URL embedded in that CA’s issued certificates’ CDP extension. |
| CRL (delta) | GET /crl/{caId}/delta.crl |
Per-CA delta CRL, published on the same schedule. |
| OCSP | POST /ocsp/{caId} |
DER OCSPRequest body; the response is signed by that CA — the URL embedded as the AIA OCSP location in issued certificates. |
| OCSP (GET) | GET /ocsp/{caId}/{base64} |
RFC 5019 form, request encoded into the URL path. |
A background publisher regenerates CRLs on the schedule set in Settings → CRL, which also offers an immediate-publish option for when a revocation shouldn’t wait for the next cycle.
Revoke on a disabled AD account or computer
A RevocationRule of type ADUserDisabled closes the gap between a certificate and the identity behind it: it looks up the UPN or machine FQDN on every active, AD-backed certificate against a configured Active Directory domain, and takes the rule’s configured action — revoke, suspend or alert only — the moment that account or computer object is disabled. Whether a certificate whose AD object has been deleted outright is treated the same way is a separate setting on the rule, since “not found” can also mean a directory lookup that failed for an unrelated reason.
A directory outage doesn’t get treated as mass revocation. If the domain becomes unreachable, the rule can be configured to suspend the certificates it can no longer verify once the outage passes a tolerance you set — never revoke them outright — and it lifts that hold automatically the moment the directory answers again. A transient LDAP error on a single lookup is skipped rather than acted on, so one slow query doesn’t revoke a certificate that was never actually a problem.
Local cleanup on the agent’s next heartbeat
Revoking a certificate at the server doesn’t remove it from the machine that holds it. On its next successful heartbeat, an agent is told which of its own template-issued certificates are now revoked and deletes them from the local certificate store immediately, rather than waiting for the normal renewal cycle to notice — which would otherwise only run near the certificate’s own expiry. A held (suspended) certificate is deliberately left alone by this cleanup: a hold is meant to be reversible, and deleting the local file on every heartbeat while it’s merely on hold would turn “lift the hold” into “re-enrol from scratch.”
Limits
Revocation only reaches what CertOps itself controls. A device’s agent removes a revoked certificate from its own store, and a downstream system that actually checks the CRL or OCSP responder will refuse it — but a system that was never configured to check revocation at all keeps accepting the certificate until it expires on its own. That is a property of X.509 revocation in general, not something specific to this feature.
ADUserDisabled needs its own AD domain configured and reachable to do anything. With no domain bound, or the domain disabled, the rule logs a warning and skips its scan entirely rather than acting on stale information.
A held certificate is not deleted locally, by design. Only a genuinely revoked certificate is removed from a device’s store on heartbeat; a suspended one stays in place so lifting the hold can resume the same certificate rather than forcing re-enrolment.