How to Revoke Let’s Encrypt Certificates on Ubuntu Linux
Revoking a Let’s Encrypt certificate on Ubuntu Linux immediately stops that SSL/TLS certificate from being used for your website, meaning browsers will no longer trust it.
You might need to revoke a certificate if you think its secret key has been stolen, or if you’ve moved your website to a new host that handles its own security certificates.
For example, if you start using Google Cloud Load Balancing, which manages certificates for you, you’ll want to revoke any old Let’s Encrypt ones.
This stops any confusion and makes sure you only have the right certificates active for your site.
Revoke a Let’s Encrypt certificate by running `certbot revoke –cert-path /etc/letsencrypt/live/your_domain/cert.pem –key-path /etc/letsencrypt/live/your_domain/key.pem`. Confirm package removal with `sudo apt purge letsencrypt certbot`. Finally, delete the configuration directory using `sudo rm -rf /etc/letsencrypt`.
Validate Certificate file
Before revoking a Let’s Encrypt certificate, you must first confirm you have the right certificate file. Revoking a certificate is a permanent action that cannot be undone. Once a certificate is revoked, browsers will show warnings because the certificate authority will no longer consider it trustworthy.
When a certificate is revoked, the certificate authority publishes this information via the Online Certificate Status Protocol (OCSP), a system that browsers can query to check a certificate’s validity. Some browsers then check OCSP to verify if they should trust the certificate.
Revoke a Certificate for example.com
A Let’s Encrypt certificate for your domain, such as example.com, can be revoked using a specific command. This command prompts Certbot to begin revoking your certificate file. Remember to replace the example paths with the actual locations of your certificate and key files.
certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/key.pem
Let’s Encrypt typically stores its certificates and corresponding keys in the /etc/letsencrypt/live/example.com/ directory. Remember to replace example.com with the actual domain name for which you issued the certificate.
After running that command, you’ll be asked to confirm that you want to remove the certificate’s directory and folders. Type ‘y’ for yes.
Uninstall Let’s Encrypt | Certbot
To completely stop using Let’s Encrypt and Certbot on your Ubuntu system, uninstall them with a few commands. These commands will remove the software and all its related packages. You will need to type ‘y’ to confirm the removal when prompted.
sudo apt update sudo apt purge letsencrypt && sudo apt purge certbot
After running those commands, you’ll be asked to confirm that you want to remove the listed packages. Type ‘y’ for yes.
Finally, run the commands below to remove Let’s Encrypt directories.
sudo rm -rf /etc/letsencrypt
That should complete the process!
Conclusion:
You’ve now learned how to revoke Let’s Encrypt certificates and uninstall associated packages and directories. If you encounter any issues with these steps, please leave a comment below.
You might also find the following post helpful:
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
key.pem isn’t there but privkey.pem is. What should I do?