Revocation

Expiry, Block or Both

Expiry is permanent, but it takes as long as the anchor's credential has left to run. A block takes effect on each member as it arrives, and lasts until it ends or a member lifts it. A block does not change the credential.

To remove a machine at once and for good, use both.

Expiry

Revocation is expiry. A credential that is not renewed lapses, and from then on every member refuses its holder.

Members silently refuse the holder's knock, the signed message it sends before it connects. They close its open connections and tell it that it needs a new credential. Nothing is sent to other members, no list is kept, and no machine has to be reachable.

• The credential lifetime is the longest a removal can take, and it is fixed when the credential is issued. A shorter lifetime removes a machine sooner, but it must be renewed more often.
• You can replace a delegation with a shorter one, but not an anchor credential, because its holder will not install a shorter one. Without a block, an anchor with a ten-year credential stays admitted for ten years.
• Only anchors are revoked this way. When a delegation lapses, nothing beneath it is removed. The tree is cut at that point instead. See Cuts in the Tree.

On a sovereign network, revoking a machine in the guardian console uses expiry: the guardian never renews the machine's credential again. For the guardian's side, see Revocation and Blocks.

To see when a machine's credential runs out, read the credential row of sudo conflux status. The anchor status below it shows renew by and works until.

Blocks

A block makes every member treat an anchor as an outsider, like an anchor from another tree. Use it when expiry would take too long.

The blocked anchor keeps running and is not told. Members refuse its knock and close its connections. They send nothing to it and carry nothing for it. Nothing it signs after the block counts.

• A block is part of the realm's knowledge, not an order. Every member stores it and passes it on, including to members that were away, so the target never needs to be reachable. The block command reports how many members the block reached.
• The issuer's credential must carry block. The target must also be proved to be in the issuer's realm, by a connection or by its credential chain. A block on an AnchorID that no member has met is refused.
• A block stays in force after its issuer's credential lapses.
• A block is not a revocation. The credential still verifies, and a member that the block has not reached yet still admits the anchor. Only expiry removes a machine for good.
• A block applies only inside its own realm. A realm above may carry a sub-realm's traffic, but cannot block the sub-realm's members.

Ending and Lifting a Block

A block without an end lasts until any member that holds block lifts it, whoever issued it. A block with an end ends at that time on every member. To undo a block on a mistyped AnchorID, unblock it.

How a block ends decides what counts afterwards:

• If the block reaches its end, or its own issuer lifts it, the block counts as if it had never existed. What the anchor signed in the meantime counts.
• If another member lifts the block, the anchor is a member again from that moment. What it signed while it was blocked still does not count.

On a sovereign network, blocks come from the guardian's admin node in the realm, with a reason and an optional end. For the guardian's side, see Revocation and Blocks.

Shutting a Machine Out

Run these commands on a member whose credential carries block. On a sovereign network with console control turned off, this is an operator's conflux machine with a short-lived control credential.

Inspecting Blocks

$ sudo conflux blocks
ANCHOR      BY          SINCE                 UNTIL      REASON
ao6zcnoeaa  cyhgl55pie  2026-09-12T09:03:38Z  unblocked  decommissioned

$ sudo conflux events
14:02:11  blocked              ao6zcnoeaa decommissioned

Each member raises a blocked event when a block reaches it, and an unblocked event when the block is lifted or ends.

The blocked machine is not told. If it shows DATA no against every peer in sudo conflux peers, it may be blocked. Run blocks on another member to check.