---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Quorum Controlled Certificate Revocation

# Quorum Controlled Certificate Revocation {#ariaid-title1}

* Release version: Zurich
* 
* Updated August 11, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The quorum-controlled certificate revocation for Code Signing certificates provides a secure mechanism for a Code Signing admin to revoke Code Signing certificates. The revocation process involves submitting a request that requires approval from multiple stakeholders. This workflow helps to prevent accidental or unauthorized
revocations.

This topic provides the high-level process overview for securely revoking certificates between a trusted instance and a protected instance using a quorum-based approval workflow.

* Request creation and export (Trusted instance): Initiate a quorum certificate revocation by creating a request with the required configuration properties. Export the update set, which includes the revocation request and related data. See [Export Revocation Request Configuration](https://www.servicenow.com/docs/x1kaKecenBB_aKyGq_Y~~Q "Start the certificate revocation process by selecting the certificate that you want to revoke. Provide the required configuration properties. Export this transaction as part of an update set, which is imported into the protected instance for approval and execution.")
* Import and approval (Protected instance): Import the update set into the protected instance. Approvers receive notifications and must complete the approval workflow before the certificate is deleted. See [Import the revocation request configuration](https://www.servicenow.com/docs/SSC7Cq3KmlyRfsn9_SrcyQ "Import the update set into the protected instance to initiate the certificate revocation process. Approvers receive email notifications and they should complete the approval workflow before the certificate is revoked. The approval means that the revocations are confirmed, authorized, and traceable for security and compliance purposes.")
* Optional MID Server restart: If enabled in the configuration, MID Servers on the protected instance are restarted after the certificate revocation. This forces immediate certificate resynchronization but can result in data loss for unprocessed or cached events. See [Approve certificate revocation](https://www.servicenow.com/docs/A5gI2cbXIzR2f~ha9PuxjA "Review and approve certificate revocation requests from the email approval notifications that are sent to your registered email address. Review the approval notification and select the Click here to approve or Click here to reject link to access the protected instance and act. You can also access the approval request and the code-signing quorum request directly from the email.")

{#certificate-revocation__ul_ofw_nmz_z2c}  
Note:  
Your update setexpires after the time window defined by the **`com.snc.kmf.signature.validity_window`** property. If it expires, you can export a new signed update set
from the trusted instance. This validity window applies to all update set operations, including export, import, and enabling Code Signing. This validity window is not related to the request time window that you specify when creating the request.
* **[Export Revocation Request Configuration](https://www.servicenow.com/docs/x1kaKecenBB_aKyGq_Y~~Q)**   
  Start the certificate revocation process by selecting the certificate that you want to revoke. Provide the required configuration properties. Export this transaction as part of an update set, which is imported into the protected instance for approval and execution.
* **[Import the revocation request configuration](https://www.servicenow.com/docs/SSC7Cq3KmlyRfsn9_SrcyQ)**   
  Import the update set into the protected instance to initiate the certificate revocation process. Approvers receive email notifications and they should complete the approval workflow before the certificate is revoked. The approval means that the revocations are confirmed, authorized, and traceable for security and compliance purposes.
* **[Approve certificate revocation](https://www.servicenow.com/docs/A5gI2cbXIzR2f~ha9PuxjA)**   
  Review and approve certificate revocation requests from the email approval notifications that are sent to your registered email address. Review the approval notification and select the Click here to approve or Click here to reject link to access the protected instance and act. You can also access the approval request and the code-signing quorum request directly from the email.