How to Revoke Let’s Encrypt Certificates on Ubuntu Linux
Revoking a Let’s Encrypt SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificate on Ubuntu Linux stops the digital security file from working immediately so web browsers stop trusting it. You cancel a certificate when your secret private key gets stolen or a new web host takes over managing your site security.
Moving your domain to a service like Google Cloud Load Balancing means Google handles security certificates for you, so you must remove your old Let’s Encrypt files from your server. This cleanup step stops browser warning errors and keeps your active website security up to date.
Revoke a Let’s Encrypt certificate by running `certbot revoke –cert-path /etc/letsencrypt/live/your_domain/cert.pem –key-path /etc/letsencrypt/live/your_domain/key.pem`. Confirm package removal with `sudo apt purge letsencrypt certbot`. Finally, delete the configuration directory using `sudo rm -rf /etc/letsencrypt`.
Validate Certificate file
Validating your certificate file before you revoke let’s encrypt certificates ensures you target the correct domain and prevent accidental downtime. Checking the exact file path beforehand confirms you have the right file ready for the revocation process.
Revoking a certificate alerts the certificate authority via the Online Certificate Status Protocol (OCSP). Browsers query this system to verify whether they should still trust the site.
Revoke a Certificate for example.com
Revoking a Let’s Encrypt certificate for your domain, such as example.com, requires using the Certbot tool with specific paths to your certificate and key files. Running this command tells the certificate authority to immediately invalidate the specified security file.
certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/key.pem
Let’s Encrypt typically stores its certificates and corresponding keys in the /etc/letsencrypt/live/example.com/ directory. Remember to replace example.com with the actual domain name for which you issued the certificate.
After running that command, the system asks you to confirm that you want to remove the certificate's directory and folders. Type 'y' for yes.
Uninstall Let's Encrypt | Certbot
Uninstalling Let's Encrypt and Certbot from your Ubuntu system removes the software and all related packages using the apt package manager. This complete cleanup stops all automated renewals and removes the utility from your server.
sudo apt update sudo apt purge letsencrypt && sudo apt purge certbot
After running those commands, the system asks you to confirm that you want to remove the listed packages. Type 'y' for yes.
Finally, run the commands below to remove Let's Encrypt directories.
sudo rm -rf /etc/letsencrypt
The cleanup is complete.
Conclusion:
You now know how to revoke Let's Encrypt certificates and remove associated packages and directories. If you encounter any issues with these steps, leave a comment below.
You might also find the following post helpful:
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
key.pem isn’t there but privkey.pem is. What should I do?