HTTP 403.13 during SCCM client push

Question

We have multiple forest connected to a shared SCCM 2012 R2 site.
The site is in SSL only mode
With one forest we have problems pushing clients from SCCM.
Install works fine but soon as the client connects to the MP we get HTTP 403.13 failures.
RootCA certs have been added to SCCM
RootCA certs of the remote forest are added both sided to trusted root CA
CRL can be checked both sides using IE.
Still IIS logs on the MP show
2014-08-07 08:14:57 managementpointip CCM_POST /ccm_system_windowsauth/request - 443 - hostip ccmhttp - 403 13 2148081683 34
ccm messaging logs show
Post to https://MPFQDN/ccm_system_windowsauth/request failed with 0x87d00231
The following registry keys have been set to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
ClientauthTrustmode REG_DWORD 2
sendtrustedissuerlist REG_DWORD 0
The strange thing is that one forest works and one not. Both are identical configured.
Firewall ports are open.

Answer 1

Hi Torsten,
I have seen that article and yes it is CRL related. The thing is the MP is configured not to check the CRL.
Now the client push seems to ignore that value. A local install can be configured with /nocrlcheck
Still it worries me that the CRL can be accessed by the MP using a browser on the MP.
SSL Certificate bindings:
    IP:port                      : 0.0.0.0:443
    Certificate Hash             : 0317e07bab17b3f16502c1623778c1abeadbfd19
    Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
    Certificate Store Name       : My
    Verify Client Certificate Revocation : Disabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    IP:port                      : 0.0.0.0:8531
    Certificate Hash             : 0317e07bab17b3f16502c1623778c1abeadbfd19
    Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
    Certificate Store Name       : My
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled