Fix Certificate Revocation Check Unavailable Error in Windows 10/11

1. Your System Date or Time Is Wrong (Most Common Cause)

You won't believe how often this trips people up. Me included, the first time. Your computer checks the certificate's expiration date against your system clock. If the clock is off by even 5 minutes, the revocation check fails.

This error usually pops up when you try to visit a secure website or install a program that uses SSL. I see it a lot with older programs like Adobe Reader or when trying to access some corporate intranets.

Fix it now:

1. Right-click the clock in the bottom-right corner, select Adjust date/time.
2. Turn ON Set time automatically and Set time zone automatically.
3. If they're already on, turn them OFF, wait 5 seconds, then turn them back ON.
4. Click Sync now under Additional settings.
5. Restart your browser or the app that gave the error.

On Windows 11, you can also run this as admin to force a sync:

w32tm /resync

If that doesn't work, manually set the correct time and date. For example, if you're in Eastern Time and it's showing Pacific, pick the right zone. I've seen a wrong time zone cause this error too.

2. Certificate Revocation List (CRL) Download Is Blocked

Windows needs to download a list of revoked certificates from the internet. If your firewall, antivirus, or proxy blocks this download, you get the error. This is common on corporate laptops with aggressive security software.

Fix it:

1. Open Windows Security (search for it in Start).
2. Go to Firewall & network protection.
3. Click Allow an app through firewall.
4. Check that Windows Update and Internet Explorer (yes, it's used under the hood) are allowed.
5. Temporarily disable your antivirus (not recommended long-term—just to test). If the error goes away, your antivirus is the problem. Add an exception for certificate checking.

If you're using a corporate VPN, disconnect from it and try again. Some VPNs block the CRL download ports (TCP 80 and 443). I've also seen this with proxy settings in Internet Options. Go to Control Panel > Internet Options > Connections tab > LAN settings. Uncheck Use a proxy server for your LAN if it's checked and you don't use one.

3. Corrupted Certificate Store on Your PC

Less common, but annoying. Windows keeps certificates in a store that can get corrupted by malware or a bad update. This error shows up when you try to install software from a trusted publisher, like Microsoft Visual Studio or Java.

Fix it:

1. Press Win + R, type certmgr.msc, hit Enter.
2. Expand Trusted Root Certification Authorities > Certificates.
3. Look for any certificate with a red X or one that says Not trusted. Delete those (right-click > Delete).
4. Now repair the store by running this command as admin:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

After that, restart and try again. If still broken, you can manually download and import Microsoft's root certificates from the Microsoft Update Catalog. Search for 'Root Certificate Update' and install the latest .exe file.

One more thing—if you're on a really old Windows 7 or 8.1 machine, the SHA-2 code signing support might be missing. Install KB3033929 to fix that. On Windows 10 or 11, this isn't an issue.

Quick-Reference Summary Table