How to Revoke Let’s Encrypt Certificates on Ubuntu Linux
This brief tutorial shows students and new users how to revoke Let’s Encrypt SSL/TLS certificates and remove Let’s Encrypt | Certbot packages and directories.
You’d want to revoke an SSL/TLS certificate for many reasons.
If you discover that the corresponding private key to the public certificate is no longer safe, you will want to revoke the certificate and request a new one.
Or if you no longer need to use a particular certificate, you can either let it run until it’s expired or revoke it.
We recently revoked our Let’s Encrypt certificates because we migrated to Google Compute Load Balancer / Cloud CDN.
Before we migrated, we handled all our Let’s Encrypt SSL certificates, including automatic renewal requests. Since the GCP load balancer provides and manages Let’s Encrypt SSL/TLS certificates for hosts, there was no reason to manage ours anymore.
So, we revoked all our certificates and transferred the certificate requests and management to Google.
When you want to learn how to revoke Let’s Encrypt SSL/TLS certificates, follow the steps below:
Revoke a Let’s Encrypt certificate by running `certbot revoke –cert-path /etc/letsencrypt/live/your_domain/cert.pem –key-path /etc/letsencrypt/live/your_domain/key.pem`. Confirm package removal with `sudo apt purge letsencrypt certbot`. Finally, delete the configuration directory using `sudo rm -rf /etc/letsencrypt`.
Validate Certificate file
Before you revoke a certificate, you’ll want to validate the correct certificates and critical file you’re revoking since there is no reversal. Once a certificate is revoked, it will never be used again.
When you revoke a certificate, the certificate authority publishes that revocation information through the Online Certificate Status Protocol (OCSP), and some browsers will check OCSP to see whether they should trust a certificate.
Revoke a Certificate for example.com
Now that you know the certificate you want to revoke, simply run the command below to revoke a certificate for the domain example.com
certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/key.pem
Let’s Encrypt typically stores its certificates and corresponding keys in the /etc/letsencrypt/live/example.com/ directory. Replacing example.com with the domain name you issued for the certificate.
When you run the command above, you’ll get prompted to remove the certificate’s directory and folders. In most cases, you’ll want to type y for yes.
Uninstall Let’s Encrypt | Certbot
You can remove or purge the app and packages from your system if you don’t want to use Let’s Encrypt of Certbot to manage your certificates. To do that, simply run the commands below:
sudo apt update sudo apt purge letsencrypt && sudo apt purge certbot
When you run the commands above, you’ll be prompted to confirm that you want to remove the listed packages. Choose yes.
Finally, run the commands below to remove Let’s Encrypt directories.
sudo rm -rf /etc/letsencrypt
That should do it!
Conclusion:
You have learned how to revoke Let’s Encrypt certificates and uninstall and remove packages and directories installed by Let’s Encrypt packages. If you do find issues with the steps above, please comment below:
You may also like the post below:
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
key.pem isn’t there but privkey.pem is. What should I do?