# Revoke a single P2S client certificate without removing its trusted root

> Choose the revocation scope that matches the affected client.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:43+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Choose the revocation scope that matches the affected client.

## Potentially affected

Use this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.

## DSE recommendation

DSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer.

## Article

## Source facts

Microsoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps).

## Applicability

Use this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.

## DSE recommendation

DSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.

## Verification

After the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.

## Official references

[Microsoft Learn: Configure P2S server configuration – certificate authentication: PowerShell](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps).

## Primary reference

- Name: Configure P2S server configuration - certificate authentication: PowerShell - Azure VPN Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Revoke a single P2S client certificate without removing its trusted root,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-137-revoke-a-single-p2s-client-certificate-without-removing-its-trusted-root/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.