On this page
- Why you should revoke a certificate, not delete it
- What should verifiers see when you revoke a certificate?
- How do you revoke a certificate in CertiQR?
- What about expired certificates?
- When you should revoke a certificate
- Writing a good revocation reason
- Telling the holder when you revoke a certificate
- Frequently asked questions
Short answer: To revoke a certificate properly, mark it as withdrawn rather than deleting it, record a short public reason, and keep the record verifiable. Anyone who checks it then sees that you withdrew it and why. Deleting it instead makes a circulating copy impossible to judge.
Sooner or later it happens to every issuer: a certificate goes out by mistake, a regulator suspends a licence, or an investigation leads you to withdraw a qualification. How you revoke a certificate decides what a verifier sees the next time someone presents it.
Key takeaways
- Withdraw, do not delete.
- Give a short public reason – verifiers need context.
- Keep the full history of who changed what and when.
- Reinstating should be one click and also recorded.
Why you should revoke a certificate, not delete it
Once a certificate is out in the world, copies exist. If the record disappears, a verifier who scans an old copy sees “not found” – which looks exactly like a forgery. They cannot tell that it was real and then withdrawn. Worse, you lose the audit trail that shows you ever issued it.
What should verifiers see when you revoke a certificate?
- The page finds the record, so the verifier knows it is genuine.
- The status reads Withdrawn, clearly and in colour.
- The page shows the reason in plain words, for example “Issued in error – replaced by TRN-2026-0099”.
- The date of withdrawal is visible.
How do you revoke a certificate in CertiQR?
- Open the credential and choose Withdraw.
- Write the public reason the verifier will see.
- Save. The verification page shows the change at once, and the amendment history records it.
- If you reverse the decision, choose Reinstate – the history records that too.
What about expired certificates?
Expiry is different from revocation. An expired certificate was valid and simply ran out; it should still verify, as expired, with its dates. Read more in managing certificate expiry.
When you should revoke a certificate
- The certificate went out by mistake or to the wrong person.
- A licence is suspended or cancelled by a regulator.
- An investigation finds the award was obtained improperly.
- A replacement certificate supersedes the original.
Writing a good revocation reason
The public reason should be short, factual and neutral, because anyone who checks the certificate will read it. For example, “Issued in error – replaced by TRN-2026-0099” is clear and helpful. In contrast, personal details or accusations belong in your internal notes, never on the public page.
| Situation | Example public reason |
|---|---|
| Wrong details | Issued in error – replaced by a corrected certificate |
| Licence suspended | Licence suspended by the issuing authority |
| Superseded | Replaced by a newer certificate |
Telling the holder when you revoke a certificate
It is good practice to tell the holder before or at the moment you withdraw a credential. Also, if you replace it, send the new certificate at the same time. As a result, the holder is never surprised by a verifier, and your records show you acted fairly.
In addition, the ISO/IEC 27001 information security standard is a useful, independent reference if you want to read further.
Frequently asked questions
QCan I reinstate a revoked certificate?
Yes. Reinstating returns it to active and both changes stay in its history.
QShould the revocation reason be public?
A short, factual reason helps verifiers and protects you. Keep sensitive details internal and make the public reason neutral.
QIf I revoke a certificate, does its QR code still work?
No. The QR code still opens the record; it simply shows the withdrawn status and reason.
Ready to try it?
Withdraw certificates the right way – visible, explained and fully recorded. Try CertiQR free for 7 days.
Can I revoke a certificate in bulk?
Yes. Select several credentials on the list and withdraw them together, with one shared reason.
Will search engines show a revoked certificate?
Only if the result page is public and indexed. Also, you can keep verification pages out of search results in your SEO settings.
We build CertiQR, the WordPress plugin for issuing certificates and verifying them with a QR code. We write about credentials, verification and running a certificate programme.
