Knowledge Base

How to revoke a certificate when the private key is compromised

Updated on July 4, 2026

Overview

By following this article, you will revoke a certificate whose private key has been compromised and reissue a trusted replacement so your site stays protected. The process has four stages: generating a new private key and Certificate Signing Request (CSR), signing in to the Sectigo portal, revoking the compromised certificate, and requesting a reissue with the new CSR. It also explains how to confirm the revocation succeeded and how to protect your new key. This guidance is for certificate owners and administrators who manage certificates in the Sectigo portal.

Why revoking a compromised a private key matter

A compromised private key lets an attacker impersonate your website and decrypt protected traffic. Revoking the certificate marks it as untrusted so browsers reject it, which stops the misuse. Revocation is permanent — the old certificate cannot be restored — so you replace it by reissuing a new certificate with a new key and CSR.

Prerequisites

Access to your server or device to generate a new private key and CSR.

Sign-in credentials for the Sectigo portal.

Permission to manage the affected certificate order.

Steps to revoke and reissue your certificate

Generate a new private key and CSR. On your server or device, create a new private key, then generate a new Certificate Signing Request (CSR) from that key. Do not reuse the compromised key.

Revoke the compromised certificate. Open Orders, select the affected certificate, and choose Revoke. Set the reason to Private Key Compromised, then confirm the request.

Request a reissue. After revocation, select Reissue, upload the new CSR from step 1, complete domain or organization validation if prompted, then download and install the new certificate.