How to revoke SSL cert that someone create for our domain

It looks like there was a certificate made on Oct. 27, and then another today Dec. 6. Are both incorrectly issued? It looks like the name does resolve to a site which is using the certificate issued today. If you are the owner of the name and this site isn't supposed to exist, then you may want to remove it from DNS entirely, but I suspect that the server running that site is just renewing certificates like it was told to.

If you do need to revoke it, if you don't have a computer running certbot or the like, it's a bit of a pain. One way would be to get a computer, install certbot, attempt to issue a certificate for the name (probably with a manual DNS challenge, if you control DNS but not the server) and probably also another fake name so that a certificate doesn't actually get issued. Then, once you've got the "authorizations" cached, you should be able to download the certificate to revoke to the system and issue the certbot revoke command. That's the basic overview, there are some slightly-more-detailed instructions in the documentation and perhaps someone else here more familiar with certbot than I am could give better step-by-step ones.

5 Likes