Windows caches Certificate Revocation Lists (CRL) and CA certificates to quickly verify certificate chains, which can cause the client not to pick up a new CRL until the locally cached CRL has expired.

There are a number of ways this can happen, but it is most often related to certificate issues at the host or client computer.

HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\RegisteredOrganization

If RegisteredOrganization has a value, then it will be added to the subject of the CA as follows: cert:CN=<RegisteredOrganization> CA

where CN stands for Common Name, also known as FQDN.

If RegisteredOrganization has no value, then the default Certificate Authority will be used. To get this value, LogMeIn has to read the Microsoft Certificate Authority. LogMeIn automatically generates a Certificate Authority (self-signed) cert to sign its own webserver certification.

If you can connect to your host computer from another client (Mobile app, another computer, etc.), perform these steps on the Client machine.

If you cannot connect from any computer, perform these steps on the Host machine.

1. Download the certificates to the Host machine
   • https://secure.globalsign.com/cacert/root-r1.crt
   • https://secure.globalsign.com/cacert/root-r3.crt
   • https://secure.globalsign.com/cacert/gsorganizationvalsha2g2r1.crt
2. In the order above, click the certificate to start the import process.
   
3. If you are given the choice between Current User or Local Machine, choose Local Machine and click Next.
   
4. For Root-R1 and Root-R3, navigate to and store the certificates in Trusted Root Certification Authorities as below.
   
   Note: gsorganizationvalsha2g2r1.crt can be placed Automatically after the root certificates are installed.
5. Click Next and Finish.
   Important:

   • If the above was done on a Host computer, restart the host service before attempting another connection.
   • If the above was done on a Client computer, restart your computer before attempting another connection.