Retired a domain, or worried a private key leaked? Certbot can revoke a certificate (browsers stop trusting it) and delete it from the server so it is no longer renewed. Here is when to use which.
Full guide: Full Let's Encrypt guide
1. List your certificates
Note the Certificate Name of the one you want to remove.
sudo certbot certificates2. Domain retired: delete it
Stops renewal and removes its files. Remove it from your web server config first, or the server will fail to start.
sudo certbot delete --cert-name old.example.com3. Key may be compromised: revoke it
Revocation tells browsers and clients not to trust the certificate. Certbot then offers to delete it too.
sudo certbot revoke --cert-name example.com --reason keycompromise4. Replace a revoked certificate
Issue a new one with a new key straight away.
sudo certbot --nginx -d example.com -d www.example.com5. Verify
The certificate should no longer be listed, and the web config should load cleanly.
sudo certbot certificates
sudo nginx -t6. Troubleshooting
Web server will not start after delete: a config still points at /etc/letsencrypt/live/old.example.com; remove or update that server block.
sudo grep -R 'live/old.example.com' /etc/nginx /etc/apache2 2>/dev/nullFAQ
Do I need to revoke when I stop using a domain?
Usually not. Deleting it from Certbot is enough; it simply expires. Revoke only if the private key may be exposed.
Can I undo a revocation?
No. A revoked certificate stays revoked; issue a new one.
Further reading: Certbot user guide