Hi, I am trying to get the registry key settings on Windows 7 that enables / disables CryptoAPI to perform network retrieval (ie, the registry settings that enable it to extract the information present in AIA field of the certificate). If anybody has worked on this pls reply. Thanks

there is no way to configure this via registry. CryptoAPI is just a set of low-level API with various call options. Application calls required APIs with required parameters (options). You can change this behavior only if certain application allows this. Probably there is another way. I would like to hear for your task in details. My weblog: http://en-us.sysadmins.lv PowerShell PKI Module: http://pspki.codeplex.com Windows PKI reference: on TechNet wiki

ThankYou for the response. Actually my requirement is to make the client (Windows 7) use custom OCSP Responder URLs for revocation checking rather than the one present in AIA field of the server certificate. The client machines are not part of a single domain, hence GPO settings are not possible. The clients would be given choice to check revocation status of certificates using either the url present in the AIA field or using a custom OCSP responder URL. When clients utilise the url present in AIA, we are able to use certgetCertificateChain() API to get the revocation status; but when the clients want to use a custom OCSP Responder URL , i would like to know how to send the OCSP responder URL info to certGetCertificateChain() or any other API that could be used for this. I was trying to find some registry setting that would help ignore AIA field and then check the revocation status of certificates with the provided URL and utilizing certgetcertificateChain() API. Please suggest how this could be done.