Network Service Certificate Cache
Windows stores certificate retrieval data for the Network Service account in the CryptnetUrlCache, including cached certificate trust lists, CRLs, OCSP responses, and downloaded intermediate certificate files used by CryptoAPI chain building and revocation checking. This disk-backed cache speeds up TLS handshakes and signature validation for services that run as Network Service, but stale revocation data or outdated intermediates can persist past server-side changes and cause trust failures. Kudu clears the CryptnetUrlCache contents so Windows can fetch fresh certificate validation data without touching user certificates, private keys, saved accounts, or system settings.
Why clean Network Service Certificate Cache?
- An expired or superseded cached CRL or OCSP response can make a valid certificate chain look untrusted, and the user sees TLS or certificate errors in apps and services that rely on Windows trust validation
- Stale downloaded intermediate certificates in CryptnetUrlCache can keep Windows building the wrong chain after a CA rollover, showing connection failures until fresh intermediates are retrieved
- Corrupted cache entries under the Network Service profile can break CryptoAPI revocation lookups, leading to intermittent secure connection errors that disappear after the cache is rebuilt
- Large accumulations of old URL cache files slow certificate retrieval and chain building, which users notice as delayed first connections to HTTPS endpoints or slow service startup
- After a CA updates revocation information, Windows may keep using cached status data until it expires, so clearing forces a fresh fetch when users are seeing unexpected certificate warnings
- Services running as Network Service can fail outbound HTTPS requests because cached validation data no longer matches the remote server's current chain, producing update or sign-in failures in dependent apps
Cache paths Kudu targets
Windows
%WinDir%/ServiceProfiles/NetworkService/AppData/LocalLow/Microsoft/CryptnetUrlCache |
Common questions about Network Service Certificate Cache
Download Kudu and reclaim your disk space.
Available on Windows, macOS, and Linux. No account required, no feature gates, no telemetry without consent. All cleaning targets are open source and community-auditable.