---
title: "Deployment failures due to CRL Validation"
slug: "deployment-failures-due-to-crl-validation"
updated: 2025-09-04T11:10:42Z
published: 2025-09-04T11:10:42Z
canonical: "support.controlup.com/deployment-failures-due-to-crl-validation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment failures due to CRL Validation

## ControlUp Agents

### Issue

After installing the ControlUp Agent or upgrading from a previous version, the Real-Time DX Console might experience difficulties reconnecting to remote agents in environments without internet access. The agent installation fails with a timeout error, such as the following:

![An error occurred while trying to start remote service. Service Request Timeout](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/image%283%29.png)

### Cause

The Agent issues CRL authentication to the internet to validate the certificate and the session times out (internet unreachable.) For more information, see [here](https://en.wikipedia.org/wiki/Certificate_revocation_list).

Traced packets can reveal connection attempt to [cacerts.digicert.com](http://cacerts.digicert.com/).

Known IP addresses:

- 104.16.238.184
- 104.16.239.184
- 104.16.237.184
- 104.16.241.184
- 104.16.240.184
- crl3.digicert.com - aka: cs9.wac.phicdn.net IP: 72.21.91.29
- crl4.digicert.com - aka: rvip1.ue.cachefly.net IP: 66.225.197.197

### Suggested Solution

To update CTL, follow the official Microsoft instructions below:

[Microsoft Trusted Root Certificate Program Updates](https://social.technet.microsoft.com/wiki/contents/articles/31680.microsoft-trusted-root-certificate-program-updates.aspx) [Microsoft Support downloadable packages](https://support.microsoft.com/en-us/help/2813430/an-update-is-available-that-enables-administrators-to-update-trusted-a)

The suggested workaround for this issue is to bypass the Agent's need to verify the digital signature, or to update trusted and disallowed CTLs in disconnected environments in Windows.

To manually apply the workaround for this issue:

1. Go to **C:\Program Files\Smart-X\ControlUpAgent\Version 9.1.XXX**
2. On the remote machine, create a text file and name it: **cuAgent.exe.config** with the following content:

```plaintext
<?xml version="1.0" encoding="utf-8">
<configuration>
<runtime>
<generatePublisherEvidence enabled="false"/>
</runtime>
</configuration>
```

Download the text file below to use:

<editor360-custom-block data-preprocessing="true" data-sanitizationtags="p,span"><p><span class="file-view"> <span class="type type_9"></span> <span class="file-Name"> <a href="https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/cuAgent.exe.config" rel="noopener">cuAgent.exe.config</a> </span> </span></p></editor360-custom-block>

## ControlUp Monitors

### Issue

After installing the ControlUp Monitor or when upgrading from a previous version, the installation of the Monitor might fail to validate the certificate in environments without access to the internet. The monitor installation fails with a timeout error, such as the following: ![Failed to start ControlUp Monitor Service. An error occurred while trying to start remote service. Service Request Timeout](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/360000185049image002.png)

### Cause

The Monitor issues CRL authentication to the internet to validate the certificate and the session times out (internet unreachable.) For more information, see [here](https://en.wikipedia.org/wiki/Certificate_revocation_list).

Traced packets can reveal connection attempt to [cacerts.digicert.com](http://cacerts.digicert.com/).

Known IP addresses:

- 104.16.238.184
- 104.16.239.184
- 104.16.237.184
- 104.16.241.184
- 104.16.240.184
- crl3.digicert.com - aka: cs9.wac.phicdn.net IP: 72.21.91.29
- crl4.digicert.com - aka: rvip1.ue.cachefly.net IP: 66.225.197.197

### Suggested Solution

To update CTL, follow the official Microsoft instructions below:

- [Microsoft Trusted Root Certificate Program Updates](https://social.technet.microsoft.com/wiki/contents/articles/31680.microsoft-trusted-root-certificate-program-updates.aspx)
- [Microsoft Support downloadable packages](https://support.microsoft.com/en-us/help/2813430/an-update-is-available-that-enables-administrators-to-update-trusted-a)

The suggested workaround is it to bypass the Monitor’s need to verify the digital signature, or update trusted and disallowed CTLs in disconnected environments in Windows. To manually apply the workaround for this issue:

1. Go to **C:\Program Files\ControlUpMonitor\9.1.XXX**
2. On the remote machine, create a text file and name it: **cuMonitor.exe.config** with the following text:

```xml
<xml version="1.0" encoding="utf-8"?>
<configuration>
<runtime>
<generatePublisherEvidence enabled="false"/>
</runtime>
</configuration>
```

Download the text file above to use.