Retrieving CRLs (Certificate Revocation Lists)
The `usecrlchasing` value controls how Outlook retrieves Certificate Revocation Lists (CRLs) when checking the validity of a certificate.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\outlook\security\usecrlchasing
The usecrlchasing value controls how Outlook retrieves Certificate Revocation Lists (CRLs) when checking the validity of a certificate. A CRL identifies certificates that the issuing certification authority has revoked before their scheduled expiration.
The value uses the REG_DWORD data type and supports the following data:
0: Outlook uses the system default and relies on the CRL download schedule maintained by the operating system.1: Outlook always retrieves the CRL when it is online.2: Outlook does not attempt to retrieve a certificate's CRL, even when it is online.
According to the Microsoft policy template, if the policy is not defined and a certificate processed by Outlook contains a CRL download location, Outlook attempts to retrieve the CRL from that location when it is online.
Notes
Security
Current CRLs allow Outlook to determine whether a certificate has been revoked since it was issued, such as after compromise of the associated private key or improper certificate issuance.
A value of 2 prevents the CRL retrieval governed by this setting. If an up-to-date CRL is not otherwise available locally, Outlook cannot use it to identify a subsequently revoked certificate. This weakens the revocation check, but it does not automatically make the certificate trusted or bypass other signature and certificate-validation checks.
With 0, CRL freshness depends on the operating system's retrieval behavior. A value of 1 requires retrieval whenever Outlook considers itself online and is also the setting specified by the Microsoft 365 Apps security baseline.
Possible side effects
With 1, certificate validation can generate additional network requests to the CRL distribution points identified by the certificate. An unavailable or slow distribution point can delay validation or leave Outlook without current revocation information. Separate Outlook security settings determine how missing or outdated CRLs are treated.
Notes
This is a per-user Outlook setting under the Office version identifier 16.0. That identifier is shared by supported releases of Microsoft 365 Apps, Office 2019, Office LTSC, and Office 2016.
The Microsoft security baseline specifies “When online always retrieve the CRL” as its baseline default. This security-baseline value is distinct from selecting the system-default behavior.
Microsoft documentation
Microsoft Download Center: Administrative Template files (ADMX/ADML) for Microsoft Office