How to revoke a cert I did not issue

I think you’re right that the precertificate from crt.sh will not work to revoke. As a workaround, you can get the final certificate by taking the serial number from the precertificate in hex (remove any colons) and appending it to https://acme-v01.api.letsencrypt.org/acme/cert/. This will download a DER formatted certificate. To make Certbot happy you may need to convert it to PEM with openssl x509 -inform der -in FILENAME -out FILENAME.pem.

I’ll discuss with the team better ways to solve this, most likely by submitting final certificates to CT as well as precertificates.

6 Likes