Revocation and Blocks
Revoke a machine to remove it for good, block it to shut it out of its realm now, or do both in one step.
- Who
- Managers and admins revoke. Admins block and unblock
- Where
- Console → a machine's panel
Comparing Revoke and Block
When you revoke a machine, the guardian stops renewing its credential, and the decision is final. The machine keeps working until its credential lapses.
When you block a machine, every member of its realm treats it as an outsider within minutes. A block leaves the credential untouched, and you can lift it. To remove a machine at once and for good, revoke it and block it.
| Revoke | Block | |
|---|---|---|
| What it does | The guardian never renews the machine's credential again, and its telemetry stops at once | Every member of its realm treats it as an outsider: its connections close and nothing is carried for it |
| Takes effect | When its credential lapses, within 90 days by default | On each member as the block reaches it, within minutes |
| Lasts | For good. A revoked machine cannot be reinstated | Until the end you set, if any, or until it is unblocked |
| Touches the credential | Yes: it is never renewed | No |
| Who, in the console | A manager or an admin | An admin |
Expiry is permanent, but it takes as long as the credential has left to run. A block takes effect on each member as it arrives, and lasts until it ends or a member lifts it. A block does not change the credential. Use both to shut a machine out at once and remove it for good.
Revoking a Machine
The guardian revokes a machine by refusing to renew its credential. Nothing is sent to other machines, and there is no revocation list to distribute. A revoked machine therefore keeps working until its credential lapses. See Credential Lifetimes.
On Nodes, select the machine to open its panel, then choose Revoke. The dialog shows when the machine's credential runs out, and how many days away that is.
You cannot undo a revocation. To bring the machine back, commission it again. It then has a new identity and a new address.
Revoking and Blocking Together
When console control is on, an admin's Revoke dialog can also block the machine in the same step. Use this for a machine that is lost, stolen or compromised.
Open the machine's panel, choose Revoke, type its name and tick Also block it now. The button changes to Stop renewing and block.
Guardian console — Revoke and blockRevoke old-kiosk?Revocation is this guardian refusing to renew. Nothing is pushed and there is no list to distribute.old-kiosk keeps its current credential until 9 Dec 2026 — 62 days from now. Its collector credential is removed at once, so its telemetry stops now. The credential window is the revocation latency; a block shuts it out of its realm in minutes instead.Type old-kiosk to confirmold-kioskAlso block it nowEvery member of its realm treats it as an outsider from now on, without waiting for its credential to lapse. Lifted with Unblock.CancelStop renewing and block
A manager can revoke a machine but cannot block it, and revoking never blocks a machine by itself. If you are a manager, revoke the machine and ask an admin to block it.
Blocking a Machine
A block makes every member of the machine's realm treat the machine as an outsider. Its connections close, and no member carries anything for it. The machine itself is not stopped and is not told about the block.
Block a machine without revoking it when it must leave the network now but may come back, such as a laptop reported lost.
Open the machine's panel and choose Block. You need the admin role, and console control must be on.
The realm's admin node, the guardian's root node in that realm, carries out the block. It connects to the machine, is lent the block power for this action alone, and publishes the block to the realm. The power lapses after ten minutes at most, but the block stays in force.
Lifting a Block
An admin lifts a block with Unblock, on the machine's panel or next to the block on the realm's Blocks card. Unblock lifts a block whoever issued it, including a block issued from conflux with a control credential.
Each member treats the machine as a member again once the unblock reaches it. The console confirms with old-kiosk unblocked · reached 12 members as it spread.
Unblocking does not undo a revocation. A revoked machine that you unblock is let back in only until its credential lapses.
Viewing Blocks
The console shows blocks in four places:
- Nodes marks a blocked machine with a blocked badge, and the Blocked filter lists every blocked machine.
- A blocked machine's panel has a Blocked row with the start, the end and the reason.
- A realm's page has a Blocks card that every role can read. It lists the blocks the realm's admin node holds, including blocks issued from conflux. A block on an anchor the guardian did not commission shows that anchor's AnchorID.
- The realm's Control Activity shows auditors and above who blocked or unblocked each machine, from which address and with what result.
Refused Blocks
When an anchor refuses a block, the console shows the refusal in that anchor's own words. The realm's Control activity records the refusal, as it records every other action.
| Answer | What it means | What to do |
|---|---|---|
| 409, refused | A rule stopped the block: the power is not granted, the machine is in another realm, or the realm has not met the machine | Read the reason. If the realm has not met the machine, revoke it now, and block it again once it is online |
| 503, nothing sent | The admin node has no route to the machine, or is not running | Check the realm's in-band state on Telemetry, then try again |
| 504, not known | The block was sent, but no answer came back in time, so the result is not known | Check the realm's Blocks card before you try again |
Blocking from the CLI
With console control off, the console cannot block machines. Block, Unblock and Also block it now no longer appear, but the realm's Blocks card still shows the blocks in force.
To block a machine, an admin first issues a control credential with the block power from the realm's page. The admin then blocks the machine from conflux with that credential:
$ sudo conflux block -target <AnchorID> -reason 'reported lost'
A control credential lasts a day at most, and nothing renews it. For the full procedure, see Acting from the CLI.