Internet access is required for Java to check for Certificate revocation.
Both CRLs and OCSP require an internet connection to check certificate revocation status.
If an outside internet connection will be permanently disabled and only intranet access allowed, the following steps will need to be completed:
Useful information from Java's website: Java Revocation Options
Please also see this related KB: When starting a PSM session you receive the below warning: "The connection to this website is untrusted" (210649)