The individual making the request for certificate revocation shall either digitally sign requests sent via email, or the individual shall present the request in person to the RA.

Individual Revocation Request Letter

Corporate Revocation Request Letter

Note: Code signer certificates are not normally revoked when the code signer departs or is no longer with the organization. If the code signer is suspected of having signed (intentionally or unintentionally) unapproved code, the code signer certificate may be revoked by the RA.

The following authorized parties may request revocation of a certificate:

• Any End Entity may request revocation of their own certificate(s) and RAs may request revocation of any EE certificate on behalf of the EE or other authorized party

• The WidePoint IA may revoke any certificate within its domain for reasons identified in this CPS

• Other parties may also request revocation of certificates through a RA or LRA. The RA or LRA shall validate the credentials of the requesting party, and the RA shall determine if the revocation request meets the requirements of Section 4.4.1 of the WidePoint CPS.

If any individual has reason to believe that a certificate private key has been compromised, that individual is required to notify an RA or LRA of the compromise suspicion. It is the responsibility of the RA to investigate the information and determine if certificate revocation is warranted.

If so, the RA shall forward the revocation request along with documentation of the reason for the request to the IA. WidePoint-ORC will send a written notice and brief explanation for the revocation to the Subscriber.

If any of the following points apply to your current situation then immediately have your certificate revoked. If your key is compromised, report it to WidePoint at 1-800-816-5548, or email wcsc.helpdesk@widepoint.com immediately.

Circumstances for Revocation

• The certificate holder requests that the certificate be revoked.

• The certificate holder can be shown to have violated the subscriber obligations, including payment of any required fees.

• The certificate holder is no longer authorized to hold the certificate (e.g. termination of employment or change in responsibilities).

• The information in the certificate is no longer accurate, and therefore, identifying information needs to be changed (e.g. change of name or privilege attributes asserted in the Subscriber’s certificate are reduced).

• The Subscriber’s employer or organization requests revocation.

• The certificate was obtained by fraud or mistake.

• The certificate was not correctly requested, issued, or accepted.

• The certificate contains incorrect information, is defective, or creates a possibility of incorrect reliance or usage.

• Certificate private key compromise is suspected.

• The certificate holder fails to make a payment or other contractual obligations related to the certificate.

• Subscribers leaving the organizations that sponsored their participation in the PKI shall surrender to their organization’s PKI point of contact (through any accountable mechanism) all cryptographic hardware tokens that were issued, under the sponsoring organization, prior to leaving the organization. The PKI point of contact shall zeroize or destroy the token promptly upon surrender and shall protect the token from malicious use between surrender and zeroization or destruction. In all cases, whether software or hardware tokens are involved, the organization shall promptly notify an RA to revoke the certificate and attest to the disposition of the token, via a digitally signed email.
• WidePoint reserves the right to revoke any WidePoint ECA issued certificate at its discretion.