{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "slug": "dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root", "url": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/" }, "title": "Revoke a single P2S client certificate without removing its trusted root", "summary": "Choose the revocation scope that matches the affected client.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:43+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 217, "potentially_affected": "Use this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.", "dse_recommendation": "DSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer.", "primary_source": { "name": "Configure P2S server configuration - certificate authentication: PowerShell - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. Microsoft Learn.

\n

Applicability

\n

Use this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.

\n

DSE recommendation

\n

DSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.

\n

Verification

\n

After the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.

\n

Official references

\n

Microsoft Learn: Configure P2S server configuration – certificate authentication: PowerShell.

", "content_text": "Source facts\nMicrosoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. Microsoft Learn.\nApplicability\nUse this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.\nDSE recommendation\nDSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.\nVerification\nAfter the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.\nOfficial references\nMicrosoft Learn: Configure P2S server configuration – certificate authentication: PowerShell.", "content_markdown": "## Source facts\n\nMicrosoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps).\n\n## Applicability\n\nUse this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.\n\n## DSE recommendation\n\nDSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.\n\n## Verification\n\nAfter the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.\n\n## Official references\n\n[Microsoft Learn: Configure P2S server configuration – certificate authentication: PowerShell](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "url": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Revoke a single P2S client certificate without removing its trusted root", "item": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "url": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/", "headline": "Revoke a single P2S client certificate without removing its trusted root", "description": "Choose the revocation scope that matches the affected client.", "abstract": "Choose the revocation scope that matches the affected client.", "articleBody": "Source facts\nMicrosoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. Microsoft Learn.\nApplicability\nUse this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.\nDSE recommendation\nDSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.\nVerification\nAfter the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.\nOfficial references\nMicrosoft Learn: Configure P2S server configuration – certificate authentication: PowerShell.", "datePublished": "2026-09-17T16:32:43+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Revoke a single P2S client certificate without removing its trusted root" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 217, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure P2S server configuration - certificate authentication: PowerShell - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps" } } ] } }