Free tools Windows power users keep installed
One-click scans. No signup required.
You can view an expired CRL if the file still exists or the certificate authority retained it. For Windows Server 2008 and 2012, Microsoft documents how to inspect CRL history in the CA database and enable it in the Certification Authority console. An expired list is historical evidence, not a current revocation check.
First, identify what you need to check
Viewing a CRL is different from checking whether a certificate is currently revoked. An expired CRL can show details such as its issuer, update dates, and revoked entries, but it does not establish current status. For an operational decision, obtain and validate the current CRL or use the revocation mechanism configured for your environment.
As an Amazon Associate I earn from qualifying purchases.
- Historical audit: Look for a retained CRL or CA database history.
- Current certificate status: Use current revocation information, not an expired list.
- Certificate expiration: This is separate from CRL expiration. A Hongkong Post FAQ says its service does not publish revocation status for expired certificates in its CRL; that describes the service’s policy, not a universal rule. Hongkong Post e-Cert FAQ
View CRL history in Windows Server 2008 or 2012
Microsoft’s documented procedure applies to Windows Server 2008 and Windows Server 2012 Certification Authorities. Microsoft says these versions delete expired CRLs by default when a new CRL is issued. The instructions below are version-specific; verify them against the documentation for your deployed server before changing CA configuration. Microsoft: Viewing Expired Certificate Revocation List (CRL)
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For future audits, retain expired CRLs
Microsoft documents changing the CA setting and restarting the Certificate Services service to preserve expired CRLs. The change must be in place before the CRL is deleted; enabling retention does not recover a CRL that has already been removed.
#1 Best Overall
- Open an elevated Command Prompt on the CA and run
certutil -setreg CACRLFlags -CRLF_DELETE_EXPIRED_CRLS. - Restart the Certificate Services service with
net stop certsvcfollowed bynet start certsvc.
Query the CA database
To query the CRL publication fields documented by Microsoft, run:
certutil -view -out "CRLThisPublish,CRLNumber,CRLCount" CRL
Rank #2
Show CRL history in the console
Microsoft says the Certification Authority console hides CRL history by default. Enable it by running certsvc.msc /e, then inspect the CA console for the available history.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteInspect a CRL file with its certificate-management product
If you already have a CRL file, use a viewer appropriate to its format and CA product. Red Hat Certificate System documentation describes viewing the CRL header, full CRL, cached CRL, Base64-encoded contents, and delta CRL. Those are Red Hat product capabilities, not Windows CA instructions. Red Hat Certificate System Administration Guide: Managing Certificates
Rank #3
Choose the view that matches the evidence you need: a full CRL contains the list, a header view exposes metadata, and a delta CRL represents changes relative to a base CRL. Use the relevant product’s documentation to interpret its output and confirm whether the file is full or delta.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If the expired CRL is missing
Microsoft’s documented procedure explains retention and inspection; it does not provide a recovery method for a CRL that was deleted before retention was enabled. Check whether the CA database or an existing archive contains a retained copy. If none does, the cited guidance does not establish a way to recreate the exact historical CRL from that CA.
Quick Recap
Choose the right path
| Need | Where to look | Important distinction |
|---|---|---|
| Windows CA publication history | CA database with certutil, or Certification Authority console history |
The Microsoft instructions cited here cover Server 2008 and 2012. |
| Inspect an existing CRL file | A viewer for the CA product and file format | Available views and handling of full or delta CRLs vary by product. |
| Current revocation decision | The current CRL or the environment’s configured revocation mechanism | An expired CRL is historical information, not current status. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
