Certificate Revocation Explained
Revoking a certificate is how you say "this credential is no longer valid" after it has already been issued. Here is what certificate revocation actually means, when to use it, and what a revoked certificate should look like to anyone who checks.
Certificate revocation is the act of cancelling a certificate that has already been issued, so that anyone who checks it afterwards sees it is no longer valid. Issuing a credential is not always final — mistakes happen, rules change, and sometimes a certificate should never have been granted. Revocation is the mechanism that lets you correct that without pretending the certificate never existed.
What "revoked" actually means
A revoked certificate is one the issuer has formally withdrawn. The record still exists — that history matters — but its status changes from valid to revoked. When someone verifies it, they no longer see a clean pass; they see that the credential was cancelled, ideally with the date it happened. This is different from deleting a certificate, which would simply make it vanish and leave a verifier unsure whether it was ever real.
When revoking a certificate is the right call
- Issued in error — wrong recipient, wrong course, wrong date, or a duplicate.
- The requirement was reversed — an exam result was overturned, a payment was reversed, or eligibility was withdrawn.
- Misconduct or fraud — the holder cheated, misrepresented themselves, or breached the terms the credential depended on.
- A time-limited credential lapsed — some certifications must be revoked or expired once they are no longer maintained.
Revocation should be deliberate, not casual. A credential people can lose without a clear reason is a credential people stop trusting.
How revocation shows up when someone verifies
The whole point of revoking certificates is that the change is visible to whoever checks. On a well-built platform, revocation is instant: the moment you mark a certificate revoked, its public verification page — the one behind its QR code and short code — reflects the new status. An employer scanning the QR sees "revoked", not "valid". There is no waiting for a document to be re-collected, and no way for the holder to keep presenting a stale "valid" copy, because verification always reads the live record, not the printed paper.
A note on "revoke SSL certificate"
If you searched for revoking a certificate and meant an SSL/TLS certificate — the kind that secures a website — that is a different topic. Those are revoked through your certificate authority and published via mechanisms like CRLs and OCSP. This guide is about credential and document certificates — the certificates you award to people for courses, training, membership or achievements.
Best practice for revoking certificates
- Record a reason. Even a short internal note protects you if the decision is ever questioned.
- Make the status public, not just internal. Revocation only works if verifiers can see it.
- Keep the record, don't delete it. A revoked-but-visible history is more trustworthy than a gap.
- Be able to reverse it. If a certificate was revoked in error, reinstating it should be just as clean.
Revocation with QRCertificates
With QRCertificates you can revoke any certificate in one click. The credential's status flips immediately, and its verification page — reached by scanning the QR or entering the short code — shows it as revoked to anyone, with no login required. The record is preserved rather than erased, so the history stays honest, and you can reinstate a certificate if it was cancelled by mistake. Verification always reads the live status, so a revoked certificate can never be passed off as valid.
