Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a network of more than 300 machines all running on Windows Server 2003 and clients running Windows 2000 Professional and Windows XP Professional, Microsoft Certification Server in enterprise CA mode is used for issuing and revoking certificates for all users and computers. An employee who left the company last week was using a digital certificate for secure email communication and must have his certificate revoked,since it will no longer be in use. What procedure(s) must be followed to revoke this certificate? All help is greatly appreciated, thanks in advance.

share|improve this question
up vote 4 down vote accepted

You can revoke the certificate from within the Certificate Authority MMC snap-in on the server that is running the CA role.

Select the Certification Authority (Computer)-> then your CA name -> Issued Certificates -> find and select the Certificate(s) for the user in question and from the Action Menu select Revoke Certificate.

If you have disabled the user's AD account the certificate should be pretty much useless in any case.

share|improve this answer
Revoking the cert means that it will also fail CRL validation. So all those historic signed emails will start failing validation. – sysadmin1138 Sep 14 '10 at 18:16
Thank you very much for your feedback, I appreciate it. – rlopez6570 Oct 7 '10 at 3:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.