Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a Windows 2008 server with an app that uses WinHTTP for SSL sessions. The server is isolated from the internet but still tries to connect to CRL distribution points, which leads to some timeouts.

Since the server has no access to the internet whatsoever, I'd like to disable CRL checks.

I had a similar issue on a Windows 2003 server and resolved it by adjusting the following registry keys:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Http/Parameters/SslBindiongInfo/ (DWORD=1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRevocationCheck (DWORD = 1)

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Rasman/PPP/EAP/13/NoRootRevocationCheck (DWORD = 1)

That doesn't seem to be working in 2008. I've also tried disabling the CRL check from IE under Tools >> Internet Options >> Advanced.

Is there anything else I can try here?

share|improve this question

I don't, but would it work to blackhole the crl server(s)? You can add to the hosts file.

An example of this for another application is here:

Exchange Server 2007 managed code services do not start after you install an update rollup for Exchange Server 2007

share|improve this answer
That's an interesting idea, thanks. I'm not sure how that would work. Offhand, I would think that the timeout will still occur but perhaps not. – Mike B Jul 2 '12 at 20:37
It's more common that you might think. We use it to blackhole our AD crl on our domain controllers because our smart card PKI does not use our AD CA. Have another look at the article, the blackhole workaround is to fix a timeout. ;-) – Greg Askew Jul 2 '12 at 20:48
Heh, just read that part. Interesting. We'll give it a try. Thank you. – Mike B Jul 2 '12 at 20:48

What we've found is whenever IIS worker process goes to sleep - by default idle time is 20 minutes and when it wakes up it goes through and checks a whole heap of things and CLR is one of the checks . Setting idle time to 0 and putting in recycling at specific is the best way to sort this .

share|improve this answer

Maybe worth looking at this blog

Disable CRL Checking Machine-Wide Control Panel -> Internet Options -> Advanced -> Under security, uncheck the Check for publisher's certificate revocation option

Disable CRL Checking For a Specific .Net Application See this Microsoft KB Article:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.