---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enforce CRL certificate revocation checking for outbound HTTP requests

# Enforce CRL certificate revocation checking for outbound HTTP requests {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the com.glide.communications.httpclient.fail_on_non_pass_crl_status property to control whether the platform terminates outbound HTTP requests when Certificate Revocation List (CRL) checks can't
determine revocation status.
The ability to verify certificate revocation status strengthens the authentication process. However, revocation checks are out-of-band requests to a certificate authority's revocation endpoint. Network failures, DNS resolution
issues, or unavailable revocation services may cause the check to fail and halt outbound HTTP requests, creating a potential denial-of-service condition. The denial-of-service risk is mitigated by caching of revocation check
results.

Two main approaches check certificate revocation status: Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP).

When the com.glide.communications.httpclient.fail_on_non_pass_crl_status property is set to `false` and the CRL check can't determine revocation status, the platform continues with remaining
certificate validations (hostname, expiration, signature, certificate chain).

When set to `true` and the CRL check can't determine revocation status, the platform either terminates the connection or falls back to OCSP revocation checking. If OCSP is also unable to determine revocation status,
the connection is terminated.

To configure this property:

1. Navigate to /sys_properties_list.do on the instance.
2. Set the com.glide.communications.httpclient.fail_on_non_pass_crl_status property to true.

## More information {#sc-enforce-certificate-revocation-check__section_details-enforce-cert-revocation-check}

{#sc-enforce-certificate-revocation-check__table_property_details-enforce-cert-revocation-check__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.communications.httpclient.fail_on_non_pass_crl_status |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 2.3 * CVSS rating: Low * Security risk details: Outbound HTTP requests that rely on TLS certificate validation for the remote hosts may be impacted if the CRL revocation check can't be completed. The platform may connect to remote hosts with revoked certificates, leading to a loss in authentication and possible loss in confidentiality. {#sc-enforce-certificate-revocation-check__ul_g1g_3sf_xwb} |
| Functional impact | The com.glide.communications.httpclient.fail_on_non_pass_crl_status property affects any platform functionality that makes outbound HTTP requests over TLS, for example Integration Hub or Outbound Web Services. When set to `false`, if CRL can't determine the revocation status, the platform verifies the next certificate in the chain and allows the connection with the remote host. |
| Dependencies and prerequisites | The com.glide.communications.httpclient.fail_on_non_pass_crl_status property interacts with the com.glide.communications.httpclient.disable_crl_check property. * If the com.glide.communications.httpclient.disable_crl_check property is set to `false` and the com.glide.communications.httpclient.fail_on_non_pass_crl_status property is set to `true`, the platform will perform the CRL revocation check for the certificate. * If the com.glide.communications.httpclient.disable_crl_check property is set to `true`, then the com.glide.communications.httpclient.fail_on_non_pass_crl_status property value will not have any effect. The platform will perform the OCSP revocation check for the certificate. {#sc-enforce-certificate-revocation-check__ul_dependencies} |
[ ]

{#sc-enforce-certificate-revocation-check__table_property_details-enforce-cert-revocation-check}