Unable to revoke cert

[smith]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: vault01@dmlitsolutions.com

I ran this command: certbot revoke --cert-path /media/1/vault01.dmlitsolutions.com/fullchain-1732957200.pem

It produced this output: An unexpected error occurred:
The client lacks sufficient authorization :: unable to revoke :: requester does not control all names in cert with serial "04d0f71846b8abbf062803babc9326cf86ab"

My web server is (include version): unknown

The operating system my web server runs on is (include version): unknown

My hosting provider, if applicable, is: unknown

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): unknown

[Bruce5051]

Hello @smith,

Why do you need to revoke the certificate?
Has the private key been release publicly?
Have you lost control of the domain name?

[Bruce5051]

@smith

My web server is (include version): unknown

To me it looks like Server: nginx

$ curl -Ii http://vault01.dmlitsolutions.com/.well-known/acme-challenge/sometestfile
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Tue, 18 Feb 2025 20:58:39 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://vault01.dmlitsolutions.com/.well-known/acme-challenge/sometestfile

$ curl -Ii https://vault01.dmlitsolutions.com/.well-known/acme-challenge/sometestfile
HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 18 Feb 2025 20:58:49 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
Vary: Accept-Encoding

[smith]

Thanks for the quick replay @Bruce5051, We are transferring that subdomain to another server and retiring the current server so we need to revoke it so we can request a new cert on the new server. Or at least thats how i understand it. Yes that server version looks correct

[Bruce5051]

@smith

so we need to revoke it so we can request a new cert

You can just request a new certificate without revoking it.

[Osiris]

@smith

and retiring the current server so we need to revoke it so we can request a new cert on the new server

Why?

@smith

Or at least thats how i understand it.

Where did you hear or learn this? Because it's incorrect.

[webprofusion]

@smith

we need to revoke it so we can request a new cert on the new server

You should generally only revoke a cert because of a private key compromise. You can request multiple certificate for the same same set of names, up to the certificate authorities Rate Limits. Revoking a certificate does not change the rate limit.