Work Folders not synchronizing off-network and system gives 0x80092013 error for unreachable CRL server

Question

Work Folders not synchronizing off-network and system gives 0x80092013 error for unreachable CRL server

Wilson Charlie 20

We have laptops working off-network but they fail to synchronize data with our corporate Work Folders servers. The Windows client logs report error 0x80092013. Most of the time it fails because the client cannot reach the internal CRL server to validate the Work Folders SSL certificate, so when it tries to sync, it just stops. It marks the connection as having a problem, like it needs to validate the certificate but the internal server is obviously unreachable from the outside. How do we go about publishing external CRL endpoints? We are using Windows clients.

0 comments

1 answer

Your answer

Answer 1

Hello,

error 0x80092013 is a direct certificate validation failure: the client cannot download or reach the Certificate Revocation List (CRL) referenced in the Work Folders SSL certificate. Because your CRL Distribution Point (CDP) is internal only, off‑network laptops cannot validate the certificate chain and the sync process halts.

To resolve this, you need to publish CRLs externally and ensure the certificate used by Work Folders points to an accessible CDP. In practice, this means reissuing the SSL certificate with CRL Distribution Points that are reachable from the internet. On your internal CA, configure the CDP extension to include both internal and external URLs. For example, add an HTTP path such as http://pki.company.com/crl/<CAName>.crl that is published through your reverse proxy or web server and accessible externally. After updating the CA configuration (certsrv.msc > Properties of the CA > Extensions tab), reissue the certificate used by Work Folders so that its CDP points to the external location.

You must also ensure that the CRL file itself is published to the external web path. This is done by configuring the CA to automatically publish CRLs to the external directory, or by scripting a copy of the CRL file from %systemroot%\system32\certsrv\certenroll to your public web server. Once the CRL is accessible externally, off‑network clients can validate the certificate chain and the sync will succeed.

If you are using Intune to deploy the VPN and Work Folders profiles, make sure the certificate profile includes the correct CDP extension. Without this, the client will continue to fail validation.

In short, the fix is to reconfigure your PKI so that CRLs are published externally and referenced in the Work Folders SSL certificate. This ensures that off‑network clients can validate the certificate and eliminates error 0x80092013.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.