---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable CRL-based certificate revocation checking for outbound HTTP requests

# Enable CRL-based certificate revocation checking for outbound HTTP requests {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the com.glide.communications.httpclient.disable_crl_check property to control Certificate Revocation List (CRL) revocation checking for outbound HTTP requests over Transport Layer Security
(TLS).
When the com.glide.communications.httpclient.disable_crl_check property is set to `false`, CRL checking remains available as a revocation-check mechanism. Outbound HTTP requests over TLS that connect to hosts whose certificates only provide a CRL distribution point have their certificate checked against that CRL before the connection proceeds.

When set to `true`, CRL checking is never performed, regardless of whether a certificate provides a CRL distribution point. The platform relies solely on Online Certificate Status Protocol (OCSP) for revocation checking.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Set the com.glide.communications.httpclient.disable_crl_check property to `false`.

## More information {#sc-enable-crl-based-checking-for-outbound-http-requests__section_details-enable-crl-based-checking}

{#sc-enable-crl-based-checking-for-outbound-http-requests__table_property_details-enable-crl-based-checking__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.communications.httpclient.disable_crl_check |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | false |
| Default value | false |
| Fallback value | false |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Security risk rating: High * CVSS score: 7.5 * Security risk details: When set to `true`, certificates that only provide a CRL distribution point (and no OCSP responder) are never checked for revocation. Certificates encountering an OCSP processing error can't fall back to a CRL-based check. The platform can establish outbound HTTPS connections to hosts with revoked certificates. This results in loss of authentication and possible loss of confidentiality. |
| Functional impact | When set to `false`, certificates with only a CRL distribution point are checked against the CRL before the outbound TLS connection proceeds. If the certificate authority's CRL endpoint can't be reached, the platform's handling is governed by the com.glide.communications.httpclient.fail_on_non_pass_crl_status property. |
| Dependencies and prerequisites | The com.glide.communications.httpclient.disable_crl_check property has no effect unless the com.glide.communications.httpclient.verify_revoked_certificate property, the overall gate for certificate revocation checking, is set to `true`. The com.glide.communications.httpclient.disable_crl_check property interacts with the com.glide.communications.httpclient.fail_on_non_pass_crl_status property: * When com.glide.communications.httpclient.disable_crl_check is set to `true`, the fail_on_non_pass_crl_status property has no effect, since CRL checking is never performed. * When com.glide.communications.httpclient.disable_crl_check is set to `false`, the fail_on_non_pass_crl_status property determines whether the platform terminates connections when CRL checks can't determine revocation status. {#sc-enable-crl-based-checking-for-outbound-http-requests__ul_dependencies} |
[ ]

{#sc-enable-crl-based-checking-for-outbound-http-requests__table_property_details-enable-crl-based-checking}