Check for server certificate revocation
This policy controls whether Internet Explorer checks the revocation status of server certificates.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocationHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CertificateRevocation
This policy controls whether Internet Explorer checks the revocation status of server certificates. A certification authority can revoke a certificate when, for example, its private key has been compromised or the certificate should no longer be accepted.
When the policy is enabled, Internet Explorer checks whether the server certificate presented to it has been revoked. Windows can use a valid cached or newly retrieved Online Certificate Status Protocol (OCSP) response or certificate revocation list (CRL) for this purpose. When the policy is disabled, Internet Explorer does not perform this revocation check. Microsoft documents the same behavior when the policy is not configured.
The policy is available in both Computer Configuration and User Configuration. The value under HKLM represents the computer policy, while the value under HKCU represents the user policy.
Notes
Security
Without revocation checking, Internet Explorer can continue to treat a certificate as usable after the issuing certification authority has revoked it. In particular, this increases the risk that users will disclose confidential information to a fraudulent or no longer trustworthy endpoint using a compromised certificate.
This policy controls only the revocation check for server certificates. It does not replace the remaining certificate-chain, name, or validity-period checks. It also does not enforce revocation checking for every TLS client or Windows component.
Possible side effects
Online revocation checking can generate additional requests to OCSP or CRL endpoints. If suitable revocation information is not already cached, certificate validation can wait while that information is retrieved.
Unreachable revocation services or unsuitable firewall and proxy configurations can prevent Windows from determining the certificate's status. Depending on the Internet Explorer operation involved, this can cause delays, certificate errors, or repeated proxy authentication prompts.
Notes
This is an ADMX-backed Internet Explorer policy defined by inetres.admx. Other browsers, WinHTTP, and applications that implement their own TLS or certificate validation are not necessarily governed by this setting.
A policy change might not affect Internet Explorer until the relevant browser sessions have been restarted.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP – CheckServerCertificateRevocation
Microsoft Learn: Crypt32 certificate revocation list semantics