I am trying to configure a crl with auto refresh on a 14.1 NetScaler. It is timing out and i suspect it is something on the network blocking. Can see it aging out on the firewall. Just wondering if there is a reason why it only allows http and not https and maybe this is playing a part.

CRL only support http. In case the https is hosted on that CRL as well.

I was wondering if it was on that side. I can manually download the crl if i browse the url with https.

If you know the destination CRL, you can whitelist is specifically to permit HTTP to that site only