title: Checking Cert Revocation List / OCSP working in offline mode even after clearing the cache
body: <p>I am writing some code to verify a cert and it's revocation list using <code>X509Chain</code>. I am testing with the cert from www.wikipedia.org, and testing that the code will use the CRL/OCSP cache.</p>
  
  <pre><code>        X509Chain chain = new X509Chain();
          // note: this can be offline, using a cached CRL list (but where is it stored??? Do we care???)
          chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
          chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain;
  
          result.IsValid = chain.Build(certificate);
  </code></pre>
  
  <p>When I delete the cache using <code>certutil -urlcache * delete</code>, and then run the above code using the wikipedia cert, it validates, but the new entries in the cache don't make sense to me (run certutil -urlcache *). I get these entries:</p>
  
  <pre><code>http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
  
  http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
  
  http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab
  </code></pre>
  
  <p>Is there some other level of CRL/OCSP caching going on? Even if I test with the cert from <a href="https://revoked.badssl.com/" rel="nofollow noreferrer">https://revoked.badssl.com/</a>, clear my cache, and set the revocation mode to Offline, and take my computer offline, my verification code still is able to determine that the cert has been revoked. Where does it get this information from?</p>
  
  <p>How is this possible? What is X509Chain using as a cache to make these determinations My goal is to definitively show whether the CRL and OCSP results are being cached, yet they don't show up in certutil.</p>
  
  <p>I also read that there's a system level CRL cache as well, not just for the current use. I attempted to examine and clear that as well by running powershell as the SYSTEM account. There were different entries in there, but I still got the same results after clearing that cache.
  <a href="http://powershell-guru.com/powershell-tip-53-run-powershell-as-system/" rel="nofollow noreferrer">http://powershell-guru.com/powershell-tip-53-run-powershell-as-system/</a></p>
  
  <p>For additional testing, I used certutil to verify the cert file (as my local user account), and then found the entry in the cache shown by cert util. Verification was done running this command:</p>
  
  <p><code>certutil -f –urlfetch -verify mycertificatefile.cer</code></p>
  
  <p>Does .NET Framework / CLR use a different location for CRL/OCSP caching?</p>
  
  <p>Update:</p>
  
  <p>So I've found that when using X509Chain, results only appear in the cache if the cert's Root CA is in the Trusted Root Certification. The wikipedia cert's root CA is not in my trusted Roots list. "GlobalSign Root CA -R1. Trying a new cert, whose root is DST ROot CCA X3, which is listed directly in trusted roots, does add entries to the cache. What's also strange is that if I clear teh cache, and try to verify this new cert in Offline mode, it fails validation, but the cache now contains entries for that CRL.</p>