{"id":"7d0b6f4d-77ef-427b-b31a-e318949303ff","task":"Revoke a certificate that must be invalidated (e.g. due to key compromise) using certbot revoke, then cleanly remove its local lineage with certbot delete, understanding revoke and delete are separate, non-automatic steps.","domain":"eff-certbot.readthedocs.io","steps":["Identify the certificate's name (often the primary domain) with: certbot certificates","Revoke it by name: sudo certbot revoke --cert-name example.com — or by path: sudo certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem","If the cert was originally obtained with --staging, --test-cert, or a non-default --server, you must pass that same flag to the revoke command, since ACME accounts/certs are scoped per environment.","Optionally state why it's being revoked with --reason (values: unspecified [default], keycompromise, affiliationchanged, superseded, cessationofoperation): sudo certbot revoke --cert-name example.com --reason keycompromise","If you have the certificate's private key but not the original ACME account key, revoke using it instead: certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem --key-path /etc/letsencrypt/live/example.com/privkey.pem","After revocation, Certbot will (by default) interactively ask whether to also delete the certificate; if you decline or run non-interactively, the lineage stays on disk and 'certbot renew' will keep trying (and failing) to renew it, so clean it up.","Before deleting, check nothing still references the live/ path in your web/mail server configs, e.g.: sudo bash -c 'grep -R live/example.com /etc/{nginx,httpd,apache2}' — remove those references and reload the affected service(s) first, then delete: sudo certbot delete --cert-name example.com","Official docs: https://eff-certbot.readthedocs.io/en/stable/using.html"],"gotchas":["Revoke and delete are two distinct, non-automatic operations: 'Certbot does not automatically revoke a certificate before deleting it,' and after a revoke, deletion only happens if you say yes to the prompt (or otherwise run delete yourself) — an un-deleted revoked cert will still be picked up by scheduled 'certbot renew' attempts (which will fail).","If your certificate was issued against staging/test-cert or a custom ACME server, you MUST pass the identical --staging/--test-cert/--server flag on the revoke command, or the request will hit the wrong (mismatched) environment.","Never manually delete files under /etc/letsencrypt/ — the docs explicitly warn to always use the 'delete' subcommand so Certbot's internal bookkeeping (renewal config, archive/live symlinks) stays consistent.","Deleting a certificate that's still referenced by a running Apache/nginx/Postfix config can break that server — the docs' recommended safe procedure is to update/reload server config to stop using the cert first, then run 'certbot delete'.","Revoking a certificate does not reset any Let's Encrypt rate limits — the issuance resources are already considered consumed, per Let's Encrypt's rate-limits documentation, so revoke-then-reissue does not buy you extra issuance headroom.","You don't strictly need to revoke a cert just because you've stopped using it (if its private key was never compromised) — but you'll keep getting Let's Encrypt expiration-reminder emails for it unless you do revoke."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T05:32:59.234Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T05:32:59.234Z"},"url":"https://mcp.waymark.network/r/7d0b6f4d-77ef-427b-b31a-e318949303ff"}