If you browse to
%WINDIR%\Microsoft.NET\assembly\GAC* and look at some of the DLLs in there, which are .NET assemblies, you will notice a "Digital Signatures" tab on them when you right click one of the DLLs and look at its properties.
(Right-click picture and open if new tab if too small to see)
The CDPs (CRL Distribution Points) of the certificates involved in signing these assemblies are listed here. These are the URLs that you need access to in order to validate the CRLs.
As the above screenshot shows, the answer is crl.microsoft.com. If you allow internet access to crl.microsoft.com, you should be good to go.
Here's some more info: http://social.technet.microsoft.com/wiki/contents/articles/2303.understanding-access-to-microsoft-certificate-revocation-list.aspx
When starting a .NET application, the .NET Framework will attempt to
download the CRL for any signed assembly. If the system that you are
running does not Internet access, or is restricted from accessing the
Microsoft.com domain, you might face a delay starting up or running
some applications. All managed code goes through a certificate check
against crl.microsoft.com by .net runtime before startup as stated in