This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP). W

This is the part that gets kind of confusing because there isn't a clear delineation between Persona the UI and Persona the fallback identity provider (IdP). When your cert expires, you need to get a new one from your IdP. If you already have an active session with your IdP (either by logging into your webmail, or clicking the "this is my computer" button for Mozilla's fallback), then your browser can get a new cert completely invisibly. If your session and your cert have expired, then you get prompted to authenticate again. For the Persona fallback, this means you'll be prompted for your Persona password (instead of sending you back to your email, because that's super annoying and users end up not logging into your site). If your email provider has native support for Persona, then you'll get prompted by them however they normally do login. > I'm using a public computer, is there a way for me to manually revoke a cert when I'm done using the machine? Go to login.persona.org and click "sign out." We're working on universal signout (at least for users of the fallback), but I'm not sure if that's landed in production yet.