Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web service running under IIS 7 that requires an X509 client certificate. I know that the server that it rus on needs access to in order to be able to get the CRL (Certificate Revocation List).

There is a need to change our proxy so I am attempting to investigate the impact of doing so. I have removed the global proxy settings using the command netsh winhttp proxy refesh, and also deleted the CRL cache using the command certutil -URLcache CRL delete.

However, after doing this, all calls to the web service still succeed. This suggests to me that I am missing something here.

So; If the CRL cache is cleared and the server has no way of refreshing the CRL, why do web service requets not return http 403?.

I have been unable to find adequate information from googling nor from my colleagues.

The reason I want it to fail is that I will not be confident that the new proxy settings work until I can see it broken first, if that makes sense.

I would also like to be able to force the CRL to be refeshed in order to ensure that the new proxy settings work

share|improve this question

I might be mistaken, but if the server has no way to check the CRL, there is no way to "revoke" the certificate. So hence it would continue to work. The CRL isn't an "allow" list, but rather a "deny" list.

share|improve this answer
Sounds logical but I was under the impression that if a CRL cannot be checked, cached or otherwise, then the request will be forbiden. Perhaps I was wrong? – lockstock Nov 21 '12 at 2:38
Might be dependent on the application and how it uses the cert. It might make sense to have it work that way in instances where the CRL might be blocked so the machines would continue to trust the cert even though it had been revoked. say like user or machine certs used for VPN for example.. – MikeAWood Nov 28 '12 at 20:38
Any idea where I can see/change what 'CRL lookup' settings are being used? – lockstock Nov 28 '12 at 23:58
if you open the certificate, you can see the CRL Distribution points in the cert. That should show you were it is pointing. I believe its always a URI. For example, my company uses GoDaddy for our cert and our CRL URI is – MikeAWood Nov 30 '12 at 21:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.