Certificate Revocation Failure: Fix It in 2 Minutes

Quick answer for advanced users

Open gpedit.msc → Computer Configuration → Administrative Templates → System → Internet Communication Management → Internet Communication settings → Turn off Automatic Root Certificates Update → Enabled. Then restart your browser.

Why this happens

I know this error is infuriating. You're trying to get to a site you trust — maybe your bank, your company's VPN page, or a government portal — and suddenly your browser throws a wall: "certificate revocation failure." It feels like the internet is broken.

Here's what's actually happening. When you visit an HTTPS site, your browser doesn't just check the certificate's expiration date. It also asks the internet "has this certificate been revoked?" — meaning someone said "this certificate is no longer safe." A certificate authority (like DigiCert or Let's Encrypt) runs a server called a CRL (Certificate Revocation List) or an OCSP responder that answers that question. Sometimes that server is down, slow, or blocked by your firewall. Your browser gets no answer, and it panics — locking you out.

This tripped me up the first time too. I spent hours chasing a problem that was really just a misconfigured proxy at my old company. But it can also happen on home networks, especially with older routers or ISP-level DNS filtering.

Fix it in 5 steps

1. Check if the error is the site's fault. Open a different browser (Firefox, Chrome, Edge) and try the same URL. If it works in one browser, the problem is with your browser's revocation settings, not the certificate itself.
2. Update your system time. Right-click the clock → Adjust date/time → turn on "Set time automatically" and "Set time zone automatically." A wrong clock breaks certificate validation. I have seen this on Windows 10 and 11 laptops that sat in a drawer for months.
3. Clear your browser's SSL state. In Internet Explorer or Edge (old Edge): Settings → Internet Options → Content tab → Clear SSL state. In Chrome: Settings → Privacy and security → Security → Manage certificates → click through the tabs and delete any CRL or OCSP entries if you see them.
4. Disable revocation checking temporarily. This is the nuclear option, but it works. For Chrome: go to chrome://flags and search for "Certificate Revocation." Disable "Certificate Revocation Checking." For Windows globally: open the Control Panel → Internet Options → Advanced tab → scroll to Security → uncheck "Check for publisher's certificate revocation" and "Check for server certificate revocation." Apply and restart the browser.
5. Reset the crypto service. If you're on Windows 10 or 11, open Command Prompt as Administrator and run:

   net stop cryptsvc
   net start cryptsvc

   Then run certutil -urlcache * delete and restart the browser. This clears the local cache of certificate status data that might be corrupted.

Alternative fix if the main one fails

If the steps above don't work, the problem might be deeper. Try these in order:

• Turn off your firewall temporarily. I've seen Windows Defender Firewall or third-party firewalls (like Norton or McAfee) block OCSP requests. Turn it off for 30 seconds and try the site. If it works, add an exception for the browser.
• Switch to a different DNS server. Go to network settings → change your DNS to 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare). ISP DNS sometimes blocks revocation servers.
• Use a VPN. Some corporate or school networks intercept certificate revocation checks. A VPN bypasses that.
• Manually install the root certificate. If the site is internal (like a company portal), ask your IT for the root certificate file (.cer) and install it in Trusted Root Certification Authorities. On Windows, double-click the .cer file → Install Certificate → Local Machine → Place all certificates in the following store → Trusted Root Certification Authorities.

Prevention tip

Don't leave revocation checking disabled permanently. That's like leaving your front door unlocked. Instead, figure out what's blocking the OCSP server. The most common culprit is a corporate proxy or a VPN client that intercepts HTTPS traffic (like Zscaler or Cisco AnyConnect). If you see the error only at work, talk to IT. If you see it at home, check your router's firmware — older Netgear or TP-Link routers sometimes corrupt TLS traffic. Update the router's firmware or reset it to factory defaults. Also, keep your OS updated. Windows 10 version 22H2 and Windows 11 version 23H2 fixed a bunch of revocation-related bugs.

One more thing: if you're on Chrome and see this error on Google sites specifically, your Chrome profile might be corrupted. Create a new profile (Settings → People → Add) and try the site there. I've fixed at least a dozen tickets with that single step.

That's it. You should be back on the site now. If not, drop the specific error code and OS version in the comments below — I'll help you figure it out.