How to handle certificate revocation behind a firewall which blocks revocation checks

I've fixed this by specifying a custom ServerCertificateCustomValidationCallback. The HttpClient is configured not to check the certificate revocation list, and then the callback checks to see if the certificate has CRL distribution points (which will have OID "2.5.29.31"), and does its own check including revocation if so.

private static readonly HttpClient httpClient = new(new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = createCallback(),
});

private static Func<HttpRequestMessage, X509Certificate2, X509Chain, SslPolicyErrors, bool> createCallback()
{
    var x509ChainWhichChecksRevocation = new X509Chain();
    return (_, certificate, _, sslPolicyErrors) =>
    {
        if ( sslPolicyErrors != SslPolicyErrors.None )
            return false;

        const string crlDistributionPointsOid = "2.5.29.31";
        var hasCrlDistributionPoints= certificate.Extensions.Cast<X509Extension>()
            .Any(e => e.Oid.Value == crlDistributionPointsOid);

        return !hasCrlDistributionPoints
            || x509ChainWhichChecksRevocation.Build(certificate);
    };
}