Revoke a single P2S client certificate without removing its trusted root

Source facts

Microsoft’s P2S certificate-authentication guidance distinguishes revoking an individual client certificate from removing its trusted root. Individual revocation can deny that certificate’s connectivity while other certificates from the same root continue authenticating. Removing the trusted root instead prevents authentication by all client certificates issued from that root. Microsoft Learn.

Applicability

Use this review when the approved response concerns a particular P2S client certificate or an entire issuing root. Identify the certificate fingerprint, issuing root, gateway trust configuration and intended scope before making a revocation change.

DSE recommendation

DSE recommends having the access owner state whether the objective is one-client exclusion or removal of trust in an issuer. Reconcile the selected certificate with the affected device or user record, without exposing private keys. For a root-level change, inventory the clients expected to lose access and plan replacement credentials where appropriate. Preserve the authorization and previous trust state.

Verification

After the authorized change, test the affected certificate through an approved client and check the expected denial. Where the change is individual, also test an approved unaffected certificate from the same root. Record the distinct outcomes and certificate identifiers. If all clients fail unexpectedly, inspect the root trust configuration before issuing replacement credentials indiscriminately.

Official references

Microsoft Learn: Configure P2S server configuration – certificate authentication: PowerShell.