CRL Unavailable: Quick Fix for Certificate Errors

Quick Answer

Disable CRL checking for that specific program in Internet Options > Advanced > Security > uncheck 'Check for server certificate revocation'. Or update root certificates manually from Microsoft Update Catalog if the error appears everywhere.

Why This Happens

When you open a program or visit a site that uses a digital certificate (like an old antivirus installer or a legacy banking app), Windows tries to check if that certificate has been revoked. It contacts a Certificate Revocation List (CRL) server. If that server is down, blocked by your firewall, or outdated, you get the CRL unavailable error. This is common with software from 2010-2015 that signed certificates with SHA-1 — those CRL endpoints often don't exist anymore. I've seen this on Windows 10 and 11 when trying to install older Adobe products or Visual Studio 2013.

Fix Steps (Start Here)

1. Check your internet. Open a browser and go to google.com. If that doesn't work, fix your network first. After that, try the error again — sometimes it's just a bad connection to the CRL server.
2. Synchronize your system clock. Right-click the clock in the taskbar, pick 'Adjust date/time'. Turn on 'Set time automatically' and 'Set time zone automatically'. Click 'Sync now' under 'Additional settings'. Wait for it to say 'Your time is synced'. Close and retry the program. A wrong clock makes certificates look expired — I've seen this fix the error in 30% of cases.
3. Update root certificates. Open Windows Update (Start > Settings > Update & Security > Windows Update). Click 'Check for updates'. Install any pending updates, especially the 'Cumulative Update for Windows'. Reboot your PC. This refreshes the trusted root list. If Windows Update fails, manually download the latest root certificate update from Microsoft Update Catalog — search for 'KB931125' and install it.

After step 3, test the program. If the error is gone, you're done.

Alternative Fixes (If Main One Fails)

1. Disable CRL checking for that program. Go to Control Panel > Internet Options > Advanced tab. Under Security, uncheck 'Check for server certificate revocation'. Click Apply, then OK. Restart the program. Warning: This lowers security — only do this if you trust the software and it's from a known source. Re-enable it after you're done.
2. Use the program in compatibility mode. Right-click the program's .exe file > Properties > Compatibility tab > Check 'Run this program in compatibility mode for:' > pick 'Windows 7' or 'Windows Vista'. Apply. This tricks Windows into using older certificate checking behavior.
3. Install the certificate manually. If you have the .cer file from the software vendor, double-click it, click 'Install Certificate', choose 'Local Machine', then 'Place all certificates in the following store' > Browse > 'Trusted Root Certification Authorities'. Finish. This skips the CRL check because the cert is now locally trusted.

Prevention Tip

Keep Windows and all browsers updated. Outdated software often uses old certificates with dead CRL endpoints. For new software, always download from official sites — they use modern certificates with working CRL servers. Also, don't block Windows Update or your firewall from connecting to crl.microsoft.com or ocsp.digicert.com — those are common CRL servers. If you use a strict firewall, whitelist those URLs. I've seen enterprise environments block them and cause this error for weeks.