CRYPT_E_NO_REVOCATION_CHECK SSL / TLS Origin: Network OSI layer 6 · Presentation Last updated 4 Nov 2026

curl (Windows Schannel): schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate

Windows could not contact the CA's CRL/OCSP servers to check whether the certificate is revoked, so Schannel aborted.

Exact message you may see CRYPT_E_NO_REVOCATION_CHECK (0x80092012)The revocation function was unable to check revocation for the certificateschannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECKcurl: (35) schannel: next InitializeSecurityContext failed
Explore the map of this error Full error map →
Seen on: SSL Windows

Meaning

Typical behind a firewall, proxy or corporate network that blocks the CRL/OCSP URLs. Allow outbound access to the CA's revocation endpoints, or (only as a temporary workaround) use curl --ssl-no-revoke. Offline environments need CRL caching or revocation checks configured accordingly.

Common causes

  • Firewall/proxy blocking CRL or OCSP hosts
  • Offline or restricted network
  • DNS failure for the revocation endpoint
  • CA's OCSP responder unavailable
  • Corporate TLS inspection

⚡ Quick fix

  1. Allow HTTP access to the CA's CRL/OCSP URLs
  2. Workaround: curl --ssl-no-revoke https://host
  3. Check the certificate's CRL distribution points

Detailed fix by platform

PowerShell

  1. certutil -verify -urlfetch cert.cer tests reachability of CRL/OCSP URLs

How to diagnose

  1. Network — CRL/OCSP reachable?
  2. Proxy — Blocks them?
  3. Temporary — --ssl-no-revoke?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

certificate does not have a private key (IIS) — Windows/IIS: A specified logon session does not exist / The certificate does not have a private key associated with it (SSL / TLS)certificate does not …Could not establish trust relationship for the SSL/TLS secure channel — .NET: System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel (SSL / TLS)Could not establish t…curl: (60) SSL certificate problem — curl: (60) SSL certificate problem: unable to get local issuer certificate (SSL / TLS)curl: (60) SSL certif…error setting certificate verify locations — curl: (77) error setting certificate verify locations: CAfile: /etc/ssl/certs/ca-certificates.crt CApath: none (SSL / TLS)error setting certifi…no alternative certificate subject name matches target host name — curl: (51) SSL: no alternative certificate subject name matches target host name 'example.com' (SSL / TLS)no alternative certif…ssl_stapling ignored, no OCSP responder URL — Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem" (SSL / TLS)ssl_stapling ignored,…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…CRYPT_E_N…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.