Request revocation if a private key is lost, exposed or suspected compromised, if the certified identity is no longer valid, or if the certificate was issued in error. Verified key-compromise reports are acted on without delay; other verified requests are processed within one business day.
How to request
| pki@manufactai.com with the subject “Revocation request”. Include the serial number or the certificate itself, the reason, and a contact we can call back. | |
| Self-service | Holders of a client certificate can revoke it directly: step ca revoke --cert cert.pem --key key.pem --reasonCode keyCompromise. Server certificates carry serverAuth only, so they cannot authenticate this call. Report those by e-mail and we revoke them. |
| Verification | Requests are checked against the contact agreed with the subscriber before they are executed. A request proven by possession of the private key needs no further verification and is executed immediately. |
How revocation takes effect
Passive The issuing CA refuses renewal of revoked certificates immediately. Because our certificates are short-lived (30 days by default over ACME, 90 days at most), a revoked certificate ages out quickly.
Active The CRL is regenerated by the CA on every revocation and republished at http://pki.manufactai.com/manufactai-global-tls-issuing-ca-ecc-p-256-2026.crl within 15 minutes; caches may add up to 15 minutes. Its nextUpdate is 7 days out. That is headroom for maintenance windows, not the publication delay. Relying parties with strict requirements should fetch it at least daily.
Currently revoked certificates
| Serial (hex) | Revoked | Reason |
|---|---|---|
| No certificate is currently revoked. | ||