Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my clients wants to avoid the test of certificate revocation list in one of his websites. As far as I know, we have tu put this value (CertCheckMode) to 1 in the IIS metabase:

The problem is that this configuration is not working. I'm using IIS Metabase Explorer to see that configuration. It appears OK in the W3SVC folder of the website and inherited in ROOT IIsVirtualDirectory and other virtual directory (let's name it APP) where the app actually resides.

The application is isolated into and dedicated pool. If the value appears in the virtual directory, why is IIS still trying to get the CRL?

Thanks a lot, virtual beers awaiting for solvers ;)

share|improve this question
up vote 1 down vote accepted

You can try running the command cscript adsutil.vbs SET w3svc/n/CertCheckMode 1 where n is the identifier of the web site. Let me know if that helps.

share|improve this answer
Thanks Vivek, the value was OK but the problem was related to one CTL. However this "script mode" is great to avoid editing the metabase. – Jacob84 Nov 10 '10 at 17:24

even though this is an old post, perhaps someone will run into this.

I did run into a similar situation. After much time killed:

1) The CertCheckMode configuration parameter seems to be applicable only to client certificate validation

2) .NET will validate strongly signed assemblies and generate publisher evidence -- if this functionality is enabled (by default) every time the App Pool is restarted CRL's will be checked. If there is a firewall that blocks outbound port 80, the application will simply hang until all CRL sites time out (~3-5 min)

The solution is: a) Enable outbound port 80 b) Disable generation of publisher evidence:

To do that:

In machine.config (!) this will not work in (app|web).config

     <generatePublisherEvidence> Element
        <generatePublisherEvidence  enabled="false"/>

In my case I had an empty <runtime/> tag on line 127 of the machine.config

share|improve this answer
Good related comment; to add to that, you need to target the right bitness for your application pool in machine.config - so from the Windows\Microsoft .Net\Framework folder for 32 bit, and the Framework64 folder for 64 bit. – TristanK Oct 28 '11 at 2:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.