by intentionally blocking the CRL server connectivity from SA (in my lab setup) I get the same client error message as you did (via browser). Below is the related log entry in SA event logs.
Info ERR23059 2012-04-24 06:32:46 - certlab - [127.0.0.1] Root:
ystem()[] - Error downloading CRL from 'http://xyz/CertEnroll/rootca.crl': Failed, couldn't connect to host
