How To Revoke A Letsencrypt Certificate If You Don’t Have The Account That Issued It Or The Private Key

Have you ever been in a situation where your organization stopped using cloud service and then realized that a valid certificate is still tied to the old IP address that you were assigned? That is the exact situation we were in, a scammy-looking gaming site was using the same IP address that our organization was assigned to before and was also using our valid certificate.

It would have been easy to revoke the certificate but we have no idea which account was used to issue the certificate, and we didn’t want to wait 90 days for the certificate to expire. We also didn’t want the IP address to be attributed to our organization, optics will not be good. When we look at Letsencrypt’s documentation on certificate revocation: https://letsencrypt.org/docs/revoking/, they offer three ways to do it. (1) Revoke the certificate from the account that issued the certificate – which we don’t have, (2) Use the certificate private key – which we don’t have again, and (3) Use a different authorized account – our ONLY option left.

In this tutorial, I was using Kali.

Steps:

1. Install Certbot by running: sudo apt-get install certbot
2. Do a DNS Challenge to prove your ownership of the domain (NOTE: Use the entirety of the certificate’s Common Name when doing a DNS challenge. For some reason just doing the domain didn’t work for me). Type: sudo certbot -d your_domain.com –manual –preferred-challenges dns certonly
3. You will be presented with a Name and a Value that you will need to create a TXT record into your domain registrar provider like GoDaddy.
4. Here’s what it looks like in your domain registrar provider:
5. Verify that the TXT record has been successfully deployed. Go to https://toolbox.googleapps.com/apps/dig and enter the name from Step 3.
6. Once you have verified that the TXT record has been deployed, go back to the Certbot session you have and press Enter.
7. Retrieve the Fingerprint of the certificate that you want to revoke and copy the value:
8. Open a browser and visit https://crt.sh, and search for the certificate using the fingerprint you copied above, then download the certificate:
9. It will download the file using a .crt extension. We need to change it into a .pem extension to continue with the revocation. You can just simply rename the file:
10. Now, to revoke the certificate, run the command: sudo certbot revoke –cert-path your_cert_you_renamed.pem
11. Refresh the https://crt.sh session you have to check the revocation status:
12. Don’t forget to remove/delete the TXT record.

We are all done! Congratulations on successfully revoking your certificate. I created this because I couldn’t find any HOW-TO with a detailed step-by-step online. I hope one of you will find this helpful.

If you haven’t, please subscribe to my blog!