Roll back or revoke after an incident

TLSPilot keeps previous versions of a certificate. If a new certificate causes a problem, list the versions and activate an earlier one:

Get-TLSPilotCertificateVersion -CertificateId $id
Invoke-TLSPilotCertificateRollback -CertificateId $id `
    -Thumbprint '<thumbprint from the list>'

If a private key has been compromised, revoke the certificate at the issuing CA:

Invoke-TLSPilotCertificateRevoke -Id $id `
    -Reason keyCompromise

To take a certificate out of service, first remove its deployments and then the certificate itself:

Remove-TLSPilotDeployment -CertificateId $id -Id $dep.id
Remove-TLSPilotCertificate -Id $id