Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I reset local CRL (in OS local cash) in Windows OS (XP, Windows 7) manual? We need to reset local CRL because otherwise the OS will use local CRL until "next update" period.

As described in "Manually publish the CRL":

Clients that have a cached copy of the previously-published CRL or delta CRL will continue using it until its validity period has expired, even though a new CRL has been published. Manually publishing a CRL does not affect cached copies of CRLs that are still valid; it only makes a new CRL available for systems that do not have a valid CRL.

share|improve this question
I don't understand the question. Here is a very good white paper that explains Certificate Revocation – Mark Arnott Jun 22 '11 at 14:46
Do you want new certificates to use an AD Crl Distribution Point instead of a file Crl Distribution Point or do you want to update the CRL on an existing file Crl Distribution Point? – Mark Arnott Jun 22 '11 at 14:49
@Mark Arnott the link you provided, describe the certificate revocation behavior, but in my case I want to reset the local cash for the the CRL. When OS verify the revocation status it load CRL from Crl Distribution Point in user certificate and CASH the CRL until "Next update" period in CRL. – Sasha Jun 23 '11 at 15:12
@Mark Arnot If I want to force the OS to load the new CRL before "Next update" period I need to reset the local CRL. – Sasha Jun 23 '11 at 15:14

From the “How Certificate Revocation Works” article:

certutil -urlcache crl delete

But there is a warning:

It may be necessary to restart the application or even the computer in order to flush the CRL cache in Windows XP or Windows Server 2003.

Apparently this command and other variations of it clears just the disk cache, but CRLs may also be cached in memory, so a restart of some services might be required.

For Windows Vista (and presumably 7) a better method is suggested, which should also clear CRLs cached in memory:

certutil -setreg chain\ChainCacheResyncFiletime @now
share|improve this answer

This command must be run both on the Domain Controller and the client machine.
On the domain controller run:

certutil -setreg chain\ChainCacheResyncFiletime @now
net stop certsvc
net start certsvc

On the client machine run:

certutil -setreg chain\ChainCacheResyncFiletime @now 
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.