How to use Microsoft certutil.exe –url or –urlcache to find CRL and OCSP on Windows manually, or utilize our freeware tool crlcheck.exe, which performs the same function fully automatically for all EXE files on your system.

crlcheck.exe

https://www.butsch.ch/post/crlcheck-exe-certificate-revocation-list-check-tool-to-verify-all-crl-and-ocsp-on-windows-client/

What is a CRL Certificate Revocation List file?

Each certificate authority (CA) periodically issues a certificate revocation list (CRL) to a public repository.

The CRL identifies revoked certificates by serial number.

After the CA revokes a certificate, the next CRL update will include the serial number of that certificate.

Manual steps to verify such a list

certutil.exe –url

certutil.exe is a command-line utility used in Windows operating systems to interact with cached URLs. It enables users to inspect and manipulate the cache of URLs stored locally on the computer.

certutil.exe operates in the security context of the current session context (That means the user calling it)

Verify with cerutil.exe –url

usage:

CertUtil [Options] -URL InFile | URL

Verify Certificate or CRL URLs

certutil.exe -url http://crl.globalsign.com/gsextendcodesignsha2g3.crl

Options:

CertUtil -?     — Display a verb list (command list)

CertUtil -URL -?     — Display help text for the “URL” verb

CertUtil -v -?     — Display all help text for all verbs

certutil.exe -url http://crl.globalsign.com/gsextendcodesignsha2g3.crl

If you do that will open the URL Retrieval Tool

Select CRL’s (From CDP)

Press the Retrieve button

The tool/utility from Microsoft will now try to fetch that single CRL from the internet. Thats is the process and work for a single Certificate or CRL. With our crlcheck.exe you can do that autoamtic for any EXE on your client fully automatic and save a lot fo time.

If it shows OK or VERIFIED all should be fine. Notice that CRL are 99% servced over http port 80.

This shows a failed CRL download

If you have an OK you should be able to open the Certificate Revocation List with a double click on the URL

You will now see the Serial number and revocation date list.

You can get the same list for ALL EXE files you run on your system fully automatic with our freeware tool crlcheck.exe.

Here is a sample view of the tool of the same information but for all files in the cache

https://www.butsch.ch/post/crlcheck-exe-certificate-revocation-list-check-tool-to-verify-all-crl-and-ocsp-on-windows-client/

certutil.exe –urlcache

Displays or deletes URL cache entries. It is a command-line utility used in Windows operating systems to interact with cached URLs. It enables users to inspect and manipulate the cache of URLs stored locally on the computer.

certutil.exe –urlcache CRL

certutil.exe –urlcache OCSP

certutil.exe [Options] -URLCache [URL | CRL | * [delete]]

[-f] [-v] [-split]

Options:

Options:

CertUtil -?     — Display a verb list (command list)

CertUtil -urlcache -? — Display help text for the “URL” verb

CertUtil -v -?     — Display all help text for all verbs

certutil.exe –urlcache CRL

certutil.exe –urlcache

Screenshot below shows the sample output from the Windows users CRL cache. This are CRL that the current user used.

You can archive the same using our freeware tool crlcheck.exe. You can also extract and search all information the cached CRL files like a list of Revocaked Certificates, serials and dates.

How to check if a Executable is Digital Signed and uses a CRL Certificate Revocation List

Let us check the freeware too Treesize.exe or treesizefree.exe which often i used on servers to check what uses space.

Right click on the EXE

Copy and paste the URL for the CRL from the Cert into your browser and try to open the file.

If you can open it all looks fine from the retrieval process. That is often the point where companys have problems if their clients are behind a Proxy or web filter and not allow all CRL fetching. (Blocked)

CRL and ocsp URL we had on Windows 11 23H2 system around April 2024

Tags:

Certificate Revocation Lists (CRLs), Certificate validation, pki, cache, reboot, delay, windows, debug, logon, critrix, vdi, ivanti, intunes, CRL troubleshooting, Certificate status checking, Digital certificates, Certificate management, Certutil.exe, Certificate authority (CA), Cryptographic operations, Certificate authentication, Digital signature verification, Cybersecurity, IT professionals, Cyber threats, Certificate integrity, Certificate validation processes, Security posture, Network security, Online security, Whitepapers, Certificate validation best practices, Certificate expiration, Certificate revocation, Digital transaction security, IT security management.