you can’t invalidate already signed certificates. The major browsers use a block list that can be updated at any time in order to revoke certificates from use in that location. but otherwise everything still continues to use them. Firefox uses OneCRL and CRLite. Chrome uses CRLsets.