How do you cancel a digital certificate that has been stolen?

You cannot take it back from every computer that has seen it, so the internet uses published lists of cancelled certificates instead. A digital certificate is like a passport for a website, valid until its expiry date. If the secret key behind it leaks, the passport is still stamped 'valid' until someone says otherwise. Cancelling a certificate early is called revoking it. A certificate is revoked if, for example, the certificate authority improperly issued it or its private key is thought to have been compromised.

The classic tool is the certificate revocation list, or CRL: a list of certificates that have been revoked by the issuing authority before their scheduled expiration date and should no longer be trusted. A CRL has a lifetime during which it is valid, often 24 hours or less, so browsers fetch fresh ones. A newer tool, OCSP, lets a browser ask about one certificate at a time. It has a catch: the browser has to contact a third party, which could track what websites the client is accessing.

A recent real case shows the machinery at work. Google reported that on Saturday 17 October 2026 its Chrome team received a report that the private keys of eight subordinate certificate authority certificates belonging to the company eMudhra had been compromised. Google said the keys had been made with weak randomness, so anyone could forge trusted certificates for any website, for clients that still trusted them. Under two hours later, Chrome pushed a list update, called a CRLSet, blocking them, without any browser update or restart.

Those are Google's reported facts, and the story was still developing as of October 2026. What lasts is the lesson: trust has to be cancellable, and cancelling it quickly is hard.