step ca revoke

Name

step ca revoke -- revoke a certificate

Usage

step ca revoke <serial-number>
[--cert=<file>] [--key=<file>] [--token=<ott>]
[--reason=<string>] [--reasonCode=<code>] [-offline]
[--ca-url=<uri>] [--root=<file>] [--context=<name>]

Description

step ca revoke command revokes a certificate with the given serial number.

Active Revocation: A certificate is no longer valid from the moment it has been actively revoked. Clients are required to check against centralized sources of certificate validity information (e.g. by using CRLs (Certificate Revocation Lists) or OCSP (Online Certificate Status Protocol)) to verify that certificates have not been revoked. Active Revocation requires clients to take an active role in certificate validation for the benefit of real time revocation.

Passive Revocation: A certificate that has been passively revoked can no longer be renewed. It will still be valid for the remainder of it's validity period, but cannot be prolonged. The benefit of passive revocation is that clients can verify certificates in a simple, decentralized manner without relying on centralized 3rd parties. Passive revocation works best with short certificate lifetimes.

step ca revoke currently only supports passive revocation. Active revocation is on our roadmap.

A revocation request can be authorized using a JWK provisioner token, or using a client certificate.

When you supply a serial number, you're prompted to choose a provisioner, and a provisioner token is transparently generated. Any JWK provisioner can revoke any certificate.

When you supply a certificate and private key (with --crt and --key), mTLS is used to authorize the revocation.

Certificates generated using an OIDC provisioner cannot be revoked by their serial number.

Positional arguments

serial-number The serial number of the certificate that should be revoked. Can be left blank, either to be supplied by prompt, or when using the --cert and --key flags for revocation over mTLS.

Options

--cert=file The file containing the cert that should be revoked.

--key=file The file containing the key corresponding to the cert that should be revoked.

--reason=string The string representing the reason for which the cert is being revoked.

--reasonCode=reasonCode The reasonCode specifies the reason for revocation - chose from a list of common revocation reasons. If unset, the default is Unspecified.

reasonCode can be a number from 0-9 or a case insensitive string matching one of the following options:

--token=token The one-time token used to authenticate with the CA in order to create the certificate.

--ca-config=file The certificate authority configuration file. Defaults to $(step path)/config/ca.json

--offline Creates a certificate without contacting the certificate authority. Offline mode uses the configuration, certificates, and keys created with step ca init, but can accept a different configuration file using --ca-config flag.

--ca-url=URI URI of the targeted Step Certificate Authority.

--root=file The path to the PEM file used as the root certificate authority.

--context=name The context name to apply for the given command.

Examples

Revoke a certificate using a transparently generated JWK provisioner token and the default 'unspecified' reason:

Revoke a certificate using a transparently generated token and configured reason and reasonCode:

Revoke a certificate using a transparently generated token and configured reason and stringified reasonCode:

Revoke a certificate using that same certificate to validate and authorize the request (rather than a token) over mTLS:

Revoke a certificate using a JWK token, pre-generated by a provisioner, to authorize the request with the CA:

Revoke a certificate in offline mode:

Revoke a certificate in offline mode using --cert and --key (the cert/key pair will be validated against the root and intermediate certificates configured in the step CA):