Manage and revoke Smart Credential certificates

After you activate a mobile smart credential for a certificate authority (CA), you can manage the certificates issued to that smart credential. For more information about CAs, see Manage Certificate Authorities.

How certificate revocation works

Certificate revocation works as follows:

• Deleting a smart credential or deleting a user assigned a smart credential permanently revokes all certificates associated with the smart credential.
• Unassigning a smart credential permanently revokes all verification certificates associated with the smart credential.
• Disabling a user with assigned smart credentials revokes for hold all verification certificates associated with the smart credential.
• Enabling a user with assigned smart credentials takes all verification certificates associated with the smart credential off hold.

note

If certificate revocation fails during one of these operations, the entire IDaaS action also fails. For example, if you delete a smart credential while the CA is unavailable, revocation fails and IDaaS does not delete the smart credential. To prevent this issue, enable Skip Revocation If CA Not Available when you add the CA in IDaaS. With this setting enabled, you can delete a smart credential even if the CA is unavailable. For more information, see Manage Certificate Authorities.

Manage smart credential certificates

1. Click > Members > Users. The Users List page appears.

2. Click the user ID.

3. Click the Authenticators tab. The Authenticators page appears.

4. Click to the right of the smart credential that you want to manage, then click Certificates. The Certificates for User page appears.

   The Certificates for User page lists all certificates (digital IDs) issued to the user's smart credential.

5. Do the following as needed:

   1. Click to view certificate details.
   2. Click to revoke certificates associated with the smart credential. The Revoke Certificate prompt appears. Click Revoke.
      note

      Use this option if the smart credential is compromised. Revocation is permanent.

   3. Click to place a certificate on hold. The Hold Certificate prompt appears. Click Hold.
      note

      Use this option if the user misplaces the mobile device that contains the mobile smart credential application.

   4. Click to take a certificate off hold, then click Unhold on the Unhold Certificate prompt.
   5. Click next to a certificate to export it.

6. Click Close to close the Certificates for User page.

Validate your changes

After you manage or revoke certificates, validate the result.

1. Confirm the selected certificate status reflects your action (for example, revoked or on hold).
2. Confirm certificate details are still accessible for certificates that remain active.
3. If you exported a certificate, confirm the export file downloads successfully.
4. If an action fails, verify CA availability and the CA revocation settings.