Certificate Revocation: How to Revoke a Batch You Issued

To revoke a digital certificate after you have issued it, find the credential in your issuing register by reference ID or recipient email and mark it revoked with a reason and a date. Do not delete the record. Revocation only bites if the certificate carries a QR code resolving to a live verification page you control, because that page flips to a revoked state for every copy already downloaded, printed or forwarded. A plain PDF cannot be recalled once it has left your outbox.

This guide covers the operational side: revoking at volume, fixing a batch issued against the wrong list, and keeping a record an auditor will accept. For the definition, read what a revoked certificate actually means. To weigh up a single credential, read revoke versus reissue for one certificate.

Why can you only revoke a certificate that verifies live?

Revocation is not an action on a file. It is a status change on a record that something else checks at the moment of use.

• A delivered PDF is a copy you no longer own. It sits in inboxes and shared drives, with no route back to it.
• A static QR code is no better. If it opens a stored file, scanning returns the document, never its status.
• A hosted verification page is the control point. Change the status behind it and every scan from that moment reflects the change, including the framed copy on a wall.

That is the gap between a certificate generator and an issuing system. A generator hands you files. An issuing system keeps a record you can still act on. See what the verification page carries.

How do you revoke a single certificate after delivery?

• Find the record in your register by reference ID, recipient email or batch. Your sent mail is not a register.
• Mark it revoked and record why. Assessment overturned, issued in error, credential expired. The reason makes the action defensible later.
• Scan the QR yourself. You should see a clear revoked state rather than an error or a dead link.
• Decide on notification. An administrative error deserves a short note and a corrected credential.
• Reissue as a new credential with its own ID, so the revoked record and the valid one both stay visible.

How do you revoke a whole batch issued against the wrong list?

This is the failure most issuers hit. Someone runs the upload against last term's CSV, an unfiltered export, or the same file twice. You find out after delivery.

• Stop reissuing until you have scoped it.
• Filter the register by that issuing run. Every bulk run should be identifiable as a batch, which is what makes it reversible.
• Revoke the affected rows together with a shared reason, so the batch reads as one incident.
• Rebuild the source file. Deduplicate emails, confirm the completion filter, save as UTF-8 so regional-language names survive.
• Reissue only the corrected rows, then scan a few at random to confirm valid ones verify and revoked ones do not.
• Write one line about what went wrong. That line is the difference between an incident and a habit.

Our guide to issuing certificates from a CSV covers the upload side that makes batch revocation possible.

Which tools can actually revoke after delivery?

Most certificate tools are built for the moment of creation and assume nothing will need undoing.

The second column is the one buyers skip during a trial and need within the first year. See pricing, including GST-invoiced plans for Indian issuers.

What should your revocation audit trail record?

If revocation matters for compliance, the action is not the evidence. The record is.

• Which credential, by unique ID.
• When, with a timestamp rather than a month.
• Who, tied to a named account.
• Why, from a consistent set of reasons.
• What replaced it, if a corrected credential was issued.

Auditors reviewing regulated training want to see that invalid credentials stop reading as valid, and that someone accountable made that call. Our note on audit-ready training records covers the wider evidence pack.

Can you revoke a whole batch of certificates at once?

Yes. Because certificates are issued as a batch from one upload, they can be filtered and revoked as a batch. That matters when a run went out against the wrong list, since revoking a few hundred credentials one at a time is how organisations end up leaving half of them valid.

What should you do if you issued certificates to the wrong list?

Scope it before you act. Filter the register by that issuing run, revoke the affected rows together with a shared reason, rebuild the source file, then reissue only the corrected rows as new credentials. Verify a sample by scanning before you tell anyone the problem is closed.

What does an auditor expect to see in a revocation record?

The credential ID, the revocation timestamp, the named person who performed it, a stated reason, and a link to any replacement credential. A revocation with no reason and no owner is difficult to defend when someone asks why an invalid certificate stayed live for six weeks.

Who on your team should be able to revoke a certificate?

Keep it narrow. Revocation invalidates something a person is relying on, so it belongs with the people who own the underlying decision, typically a programme lead, registrar or compliance owner. Everyone else can raise the request. A named account on every revocation is what makes the audit trail meaningful.

Does revocation cost extra, and can Indian issuers get a GST invoice?

Revocation is part of the issuing loop rather than a separate product, so it belongs with the credential you already issued. QRCertificates bills Indian issuers in rupees with a GST invoice, which is what lets a training institute, university or corporate team clear the spend through procurement.

Issue a small test batch, revoke one credential, then scan that certificate with your phone and watch the page report it as revoked. That loop takes minutes and tells you more than any feature list. Try QRCertificates free and see it end to end.