Probably SCHANNEL then.

OS must reach out crl.microsoft.com for CRL checks. https://social.technet.microsoft.com/wiki/contents/articles/...

Yes, that's the one. I wanted to start with a fully firewalled system and explicitly allow URLs as I go along. I needed to eventually allow that one through to get to a functional state (with Windows Update and MS Store running).