How to Revoke Let’s Encrypt Certificates on Ubuntu Linux
Revoking a Let’s Encrypt SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate on Ubuntu Linux stops the digital security file from working immediately so web browsers stop trusting it. You cancel a certificate when your secret private key gets stolen or a new web host takes over managing your site security.
Moving your domain to a service like Google Cloud Load Balancing means Google handles security certificates for you, so you must remove your old Let’s Encrypt files from your server. This cleanup step stops browser warning errors and keeps your active website security up to date.
Revoke a Let’s Encrypt certificate by running `certbot revoke –cert-path /etc/letsencrypt/live/your_domain/cert.pem –key-path /etc/letsencrypt/live/your_domain/key.pem`. Confirm package removal with `sudo apt purge letsencrypt certbot`. Finally, delete the configuration directory using `sudo rm -rf /etc/letsencrypt`.
Validate Certificate file
Validating your certificate file before you revoke let’s encrypt certificates ensures you target the correct domain and prevent accidental downtime. Checking the exact file path beforehand confirms you have the right file ready for the revocation process.
Revoking a certificate alerts the certificate authority via the Online Certificate Status Protocol (OCSP). Browsers query this system to verify whether they should still trust the site.
Revoke a Certificate for example.com
Revoking a Let’s Encrypt certificate for your domain, such as example.com, requires using the Certbot tool with specific paths to your certificate and key files. Running this command tells the certificate authority to immediately invalidate the specified security file.
certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/key.pem
Let’s Encrypt typically stores its certificates and corresponding keys in the /etc/letsencrypt/live/example.com/ directory. Remember to replace example.com with the actual domain name for which you issued the certificate.
After running that command, the system asks you to confirm that you want to remove the certificate's directory and folders. Type 'y' for yes.
Uninstall Let's Encrypt | Certbot
Uninstalling Let's Encrypt and Certbot from your Ubuntu system removes the software and all related packages using the apt package manager. This complete cleanup stops all automated renewals and removes the utility from your server.
sudo apt update sudo apt purge letsencrypt && sudo apt purge certbot
After running those commands, the system asks you to confirm that you want to remove the listed packages. Type 'y' for yes.
Finally, run the commands below to remove Let's Encrypt directories.
sudo rm -rf /etc/letsencrypt
The cleanup is complete.
Conclusion:
You now know how to revoke Let's Encrypt certificates and remove associated packages and directories. If you encounter any issues with these steps, leave a comment below.
You might also find the following post helpful:
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.
key.pem isn’t there but privkey.pem is. What should I do?