Revocation
When and why to revoke a subscriber certificate server-side.
A subscriber's certificate is the credential that authenticates them to Helium's Passpoint network. Until it's revoked the device can connect, even if the subscriber has uninstalled your app, churned, or had their account suspended.
Revocation is server-authoritative. The device-local
sdk.remove() clears the profile from the OS but does not revoke
the certificate at the CA. To stop a subscriber authenticating, call
the revocation API.
When to revoke
| Scenario | Action |
|---|---|
| Subscriber churns or cancels service. | Revoke server-side. Optionally also sdk.remove(). |
| Suspected fraud or abuse. | Revoke server-side immediately. |
| Subscriber requests account deletion. | Revoke server-side, then delete from your records. |
| User taps "Disable WiFi offload" in your app. | sdk.remove() is enough; no server-side action. |
| Subscriber loses their device. | Revoke server-side, then install() after replacement. |
| Certificate renewal. | Just call install(); it revokes the prior certificate for you. |
Revocation is not instantaneous on the network. Helium's RADIUS infrastructure may cache a certificate's validity for some minutes after revocation. If your use-case requires an instant cutoff, talk to your account owner about your specific SLA.
Server-side revocation versus SDK remove
| Action | Effect | Where it runs |
|---|---|---|
sdk.remove() | Deletes the profile from the device's keychain or keystore. | Device. |
DELETE …/users/… | Revokes the certificate at the CA. Future RADIUS lookups reject it. | Your backend. |
You typically want both when a subscriber leaves:
- Call the revocation API from your backend so the credential stops being valid.
- Optionally push a notification or backend signal that triggers the
device to call
sdk.remove(), so the OS stops trying to associate.
If you can only do one, do the server-side revocation. It's the one with security consequences.