In a network of more than 300 machines all running on Windows Server 2003 and clients running Windows 2000 Professional and Windows XP Professional, Microsoft Certification Server in enterprise CA mode is used for issuing and revoking certificates for all users and computers. An employee who left the company last week was using a digital certificate for secure email communication and must have his certificate revoked,since it will no longer be in use. What procedure(s) must be followed to revoke this certificate? All help is greatly appreciated, thanks in advance.


You can revoke the certificate from within the Certificate Authority MMC snap-in on the server that is running the CA role.

Select the Certification Authority (Computer)-> then your CA name -> Issued Certificates -> find and select the Certificate(s) for the user in question and from the Action Menu select Revoke Certificate.

If you have disabled the user's AD account the certificate should be pretty much useless in any case.

| improve this answer | |
  • 2
    Revoking the cert means that it will also fail CRL validation. So all those historic signed emails will start failing validation. – sysadmin1138 Sep 14 '10 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.