While each CA does have their own policies and procedures they follow regarding when to issue and revoke certificates, there is a common set of Baseline Requirements which all publicly trusted Certificate Authorities are required (by browser vendors) to follow.
The Baseline Requirements specify the following list of conditions under which a CA must revoke a certificate:
188.8.131.52. Reasons for Revoking a Subscriber Certificate
The CA SHALL revoke a Certificate within 24 hours if one or more of
the following occurs:
- The Subscriber requests in writing that the CA revoke the Certificate;
- The Subscriber notifies the CA that the original certificate request was not authorized and does not retroactively grant
- The CA obtains evidence that the Subscriber’s Private Key corresponding to the Public Key in the Certificate suffered a Key
Compromise or no longer complies with the requirements of Sections
6.1.5 and 6.1.6;
- The CA obtains evidence that the Certificate was misused;
- The CA is made aware that a Subscriber has violated one or more of its material obligations under the Subscriber Agreement or Terms of
- The CA is made aware of any circumstance indicating that use of a Fully-Qualified Domain Name or IP address in the Certificate is no
longer legally permitted (e.g. a court or arbitrator has revoked a
Domain Name Registrant’s right to use the Domain Name, a relevant
licensing or services agreement between the Domain Name Registrant and
the Applicant has terminated, or the Domain Name Registrant has failed
to renew the Domain Name);
- The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified
- The CA is made aware of a material change in the information contained in the Certificate;
- The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA’s Certificate Policy or
Certification Practice Statement;
- The CA determines that any of the information appearing in the Certificate is inaccurate or misleading;
- The CA ceases operations for any reason and has not made arrangements for another CA to provide revocation support for the
- The CA’s right to issue Certificates under these Requirements expires or is revoked or terminated, unless the CA has made
arrangements to continue maintaining the CRL/OCSP Repository;
- The CA is made aware of a possible compromise of the Private Key of the Subordinate CA used for issuing the Certificate;
- Revocation is required by the CA’s Certificate Policy and/or Certification Practice Statement; or
- The technical content or format of the Certificate presents an unacceptable risk to Application Software Suppliers or Relying Parties
(e.g. the CA/Browser Forum might determine that a deprecated
cryptographic/signature algorithm or key size presents an unacceptable
risk and that such Certificates should be revoked and replaced by CAs
within a given period of time).
Source: Version 1.4.9 of the CAB Baseline Requirements.
Be aware that these requirements only say when a CA must revoke a certificate. They do not restrict CAs from revoking certificates for reasons not in this list. Individual CAs may have their own policies which specify other conditions under which they may revoke a certificate.
As for when a CA will refuse to issue a certificate, that question is much more complicated to answer. The main reason why a CA would be required to refuse to issue a cert would be when the person or organization requesting the certificate cannot prove they are who they say they are. The details of what sort of identity proofs are required, and other conditions under which a CA must refuse to issue a certificate are, again, specified in the Baseline Requirements.
As far as I am aware, the Baseline Requirements do not require CAs to monitor whether the people or organizations they are issuing certs to are using them for illegal activities. Law enforcement is not within the scope of a CA's responsibilities.