How to Revoke a Certificate (and When You Should)
When and how to revoke a digital certificate so it shows as invalid on verification, without chasing down files already sent.
Issuing a certificate is a promise that the achievement behind it is real. Sometimes that promise has to be withdrawn: a credential was issued in error, an exam result was overturned, or misconduct came to light. Revocation is how you withdraw a certificate cleanly, so that anyone who checks it sees it is no longer valid. Here is when and how to do it.
When revocation is the right call
Revoke when the certificate should no longer be trusted as evidence of a genuine, valid achievement. Common cases include issuing to the wrong person, a duplicate, a result later found to be fraudulent, a credential obtained through cheating, or a certification that was withdrawn after the fact. Revocation is not for minor cosmetic fixes like a typo in a name, where reissuing a corrected certificate is the better path.
Revoke versus reissue
These two actions solve different problems. Reissuing replaces a certificate with a corrected version, for instance fixing a misspelled name while the achievement itself stands. Revoking declares that the certificate should not be trusted at all. Sometimes you do both: revoke the wrong one and issue a correct replacement. Knowing which you need keeps your records clean and your recipients clear on what happened.
Why you cannot just delete the file
A certificate sent by email or downloaded already lives outside your control. Deleting it from your system does nothing about the copies already in inboxes and on hard drives. This is exactly why verifiable certificates matter. When verification is tied to a live record, revoking that record means every copy, no matter where it sits, now fails verification. The file may still exist, but it can no longer prove anything.
How revocation works in practice
With a verification-based system, you open the certificate in your issuer dashboard and mark it revoked, usually with a reason and a date for your own records. From that moment, anyone who scans the QR code or enters the certificate's code sees a clear invalid or revoked status instead of a valid one. There is no need to contact recipients or hunt down copies. The check itself tells the truth.
Communicate when it matters
Technical revocation handles verification, but people deserve context. If a certificate is revoked for an administrative reason like a duplicate, a brief note to the recipient avoids confusion. For sensitive cases such as misconduct, follow your organisation's policy on what to disclose and to whom. Keep an internal record of who revoked what and why, so the decision is defensible later.
Keep an audit trail
Good revocation is documented revocation. Record the reason, the date, and who authorised it. If a recipient or a third party ever questions the status, you can explain it confidently. An audit trail also helps you spot patterns, such as a course producing repeated errors that need a process fix upstream.
Doing it with QRCertificates
QRCertificates makes revocation immediate and trustworthy. Because every certificate is cryptographically signed with Ed25519 over its data fields and verified against a live record, marking one as revoked means its QR code and short human-readable code instantly show an invalid status on one-click public verification, on any device, with no login. There is no blockchain involved, just proven public-key cryptography. Verification is always free and you pay only to issue, so withdrawing a certificate is a single action, not a scramble to recall files you can no longer reach.
