Per the draft 9 spec, “The server MUST consider at least the following accounts authorized for a given certificate: the account that issued the certificate.” However, using the acmev2 staging server, if I revoke using that account, I get a 403 with the detail of “JWK embedded in revocation request …

Ok, I see. I wonder if the “jwk” bullet point in section 6.2 should be clarified. Thanks for the clarification.

ACMEv2 unable to revoke using account key

_az February 26, 2018, 11:26pm 2

Looks like you might need to use the kid method if the signer is the ACME Account Key, whereas JWK is used when the signer is the Certificate Private Key.

Topic		Replies	Views
Revocation behaviour Client dev	2	1347	February 15, 2018
'JWS verification error' trying to revoke a certificate Client dev	22	4325	December 14, 2021
Revoking certificates without having the account or private key Help	5	5709	February 22, 2018
Revoke with newly-registered account (v2 API) Issuance Tech	2	718	September 3, 2019
Account Deactivation with ‘kid’ Field per ACME 8555 Client dev	6	202	March 30, 2025

ACMEv2 unable to revoke using account key

Related topics