PKI & CLM
Renew, reissue, and revoke a certificate
Renew a certificate by hand or on a schedule, reissue it with a new key or new names, and revoke it on an ADCS issuer.
After ITVA issues a certificate, you keep it current from its enrollment. This page explains how to renew a certificate by hand, how to let ITVA renew it for you, how to reissue it, and how to revoke it.
| Action | When to use it | Needs approval |
|---|---|---|
| Renew | The certificate expires soon and you need a new one with the same names | No |
| Reissue | You need a new key, a new key source, or new names before the certificate expires | Only if you change the common name or the subject alternative names |
| Revoke | The certificate must stop being trusted, for example after a key compromise | Yes |
For a DigiCert issuer, a renewal places a renewal order for the existing DigiCert order, and a reissue reissues the existing order. For an ADCS issuer, a renewal and a reissue both send a new request to the CA with the template of the enrollment.
Before you begin
- The enrollment must have an issued certificate. See Request and issue a certificate.
- To renew or reissue, your role needs the Manage permission for Enrollments.
- To request a revocation, your role needs the Manage permission for Certificates. To approve a request, your role needs Manage for Change Requests.
- You can revoke only certificates from an Active Directory Certificate Services issuer. ITVA does not revoke DigiCert certificates.
Renew a certificate
- In the PKI menu, open Enrollments.
- Open the enrollment.
- Select Renew.
- Check the private key source. ITVA selects the source of the last certificate. Change it if you need a different source.
- Fill in the fields for the source. If the source is Provide a CSR, paste a new CSR. If the source is Provide a Private Key, paste the key again.
- Select Renew.
ITVA adds the new certificate as a version of the enrollment. If the enrollment has installs with Auto Install on, the drawer lists them, and ITVA installs the new certificate on each one.
Renew a certificate automatically
Auto renew is off by default. To turn it on, open the enrollment and turn on Auto Renew. ITVA shows a message that the enrollment is configured for auto renewal.
ITVA renews the certificate 14 days before it expires. Every 8 hours, ITVA looks for enrollments that renew in the next 7 days. For each one, it adds a row to the Renewals card of the enrollment, and the row moves through these statuses:
| Status | What happens |
|---|---|
| Pending | ITVA found the renewal and is about to send the reminder. |
| Reminded | ITVA sent a reminder email to the organization administrators. The renewal waits for its renewal date. |
| Scheduled | The renewal date came, or a user selected Schedule. ITVA is about to renew. |
| Processing | ITVA emailed the administrators and is renewing the certificate. |
| Completed | ITVA renewed the certificate, emailed the administrators, and started the auto installs. |
ITVA checks for due renewals every 8 hours, so a renewal can start up to 8 hours after its renewal date. All renewal emails have the subject Certificate Renewal #<ID> | ITVA.
Renew now instead of waiting
If a renewal has the status Reminded, you can start it before its renewal date.
- Open the enrollment.
- In the Renewals card, select Schedule in the row of the renewal.
- Select Confirm.
How auto renew uses the private key source
Auto renew uses the private key source of the latest certificate:
| Private key source | At each auto renewal |
|---|---|
| ITVA Generated Private Key | ITVA makes a new key with the same algorithm. |
| Generate on Device | ITVA makes a new key on the same device, at the same path, with the same algorithm. |
| Provide a Private Key | ITVA uses the same key again. |
| Provide a CSR | ITVA cannot renew. Renew by hand with a new CSR. |
If an auto renewal fails, the row stays at Processing and the Error column shows why. ITVA does not try again, and it does not start a new auto renewal for the enrollment while this one is at Processing. Fix the cause, then renew the certificate by hand. To start auto renew again, contact support to clear the failed renewal.
Reissue a certificate
- In the PKI menu, open Enrollments.
- Open the enrollment.
- Select Reissue.
- If you need new names, change Common Name or Subject Alternative Names. The next section explains what changes.
- Select the private key source, and fill in its fields.
- Select Reissue.
If you did not change the names, ITVA reissues the certificate right away. Auto installs run the same way as for a renewal.
Reissue with new names
A change to the common name or the subject alternative names needs approval. When you change them, the drawer changes:
- You must type a Justification and select a Priority. ITVA opens a ticket to track the request.
- You cannot use Provide a Private Key. Select one of the other three sources.
- The button changes to Submit Reissue Request.
After you submit, the enrollment shows Reissue Pending instead of Reissue. Select it to open the request. When a user approves the request on the Certificate Change Request page, ITVA reissues the certificate with the new names and updates the enrollment.
Revoke a certificate
A revocation needs approval. After approval, ITVA revokes the certificate on the ADCS CA.
- In the PKI menu, open Certificates.
- Open the certificate.
- Select Revoke. The Request Certificate Revocation drawer opens.
- Select the reason. The table after these steps lists the reasons.
- If clients must see the revocation now, turn on Publish CRL immediately. Make sure that this is in an approved change window.
- In Justification, explain why the certificate must be revoked.
- Select a Priority.
- Caution: only Certificate Hold can be undone on the CA. Before you continue, make sure that the certificate and the reason are correct.
- Select Submit Revoke Request, then select Submit Revoke Request again in the dialog.
- Ask a user with Manage for Change Requests to approve the request on the Certificate Change Request page.
| Reason | Use it when |
|---|---|
| Unspecified | No other reason applies. This is the default. |
| Key Compromise | The private key of the certificate is lost or exposed. |
| CA Compromise | The key of the issuing CA is lost or exposed. |
| Affiliation Changed | The subject or the organization in the certificate changed. |
| Superseded | A new certificate replaces this one. |
| Cessation of Operation | The service that used the certificate is shut down. |
| Certificate Hold | You need to suspend the certificate for a time. This is the only reason that the CA can undo. |
While the request waits for approval, the certificate shows Revocation Pending instead of Revoke.
If Publish CRL immediately is off, clients see the revocation at the next scheduled CRL publish of the CA. If it is on, ITVA tells the CA to publish a new CRL right after the revocation.
If you revoke the latest certificate of an enrollment with auto renew on, ITVA turns off auto renew for that enrollment. To get a replacement certificate, renew or reissue the enrollment.
Check that it worked
- After a renewal or reissue, open the enrollment. Make sure that the Versions card shows the new certificate with the new expiry date.
- After an auto renewal, make sure that the row in the Renewals card shows Completed.
- After a revocation, open the certificate. Make sure that its status is Revoked, and that the change request shows Succeeded.
Troubleshooting
"This enrollment was issued from a user-provided CSR and cannot be auto-renewed"
The latest certificate came from a pasted CSR, so ITVA has no key to renew with. Select Renew and paste a new CSR. To let ITVA renew on its own, renew once with another key source.
"The certificate renewal cannot be scheduled."
You can schedule a renewal only when its status is Reminded. If the status is Pending, wait for the reminder. If it is Scheduled or later, the renewal has already started.
There is no Revoke button
ITVA shows Revoke only if all of these are true: the certificate is from an ADCS issuer, it is not revoked yet, there is no open revoke request, and your role has Manage for Certificates.
"Certificate revoked, but publishing the CRL failed"
The CA revoked the certificate, but it did not publish the new CRL. The change request shows Succeeded with this warning. Publish the CRL on the CA, or wait for its next scheduled publish.
"certificate is already revoked on ..."
Someone already revoked the certificate on the CA outside ITVA. The change request fails, and ITVA does not change the certificate.
"... is not allowed by the ... template"
The template no longer allows the key algorithm of the last certificate, or of the CSR or key that you pasted. Select an allowed algorithm and renew or reissue again.