diff --git a/lib/hx509/revoke.c b/lib/hx509/revoke.c
index 68c7976c3..1c0567acc 100644
--- a/lib/hx509/revoke.c
+++ b/lib/hx509/revoke.c
@@ -393,15 +393,24 @@ verify_crl(hx509_context context,
     int ret;
 	
     t = _hx509_Time2time_t(&crl->tbsCertList.thisUpdate);
-    if (t > time_now)
+    if (t > time_now) {
+	hx509_set_error_string(context, HX509_CRL_USED_BEFORE_TIME,
+			       "CRL used before time");
 	return HX509_CRL_USED_BEFORE_TIME;
+    }
 
-    if (crl->tbsCertList.nextUpdate == NULL)
+    if (crl->tbsCertList.nextUpdate == NULL) {
+	hx509_set_error_string(context, HX509_CRL_INVALID_FORMAT,
+			       "CRL missing nextUpdate");
 	return HX509_CRL_INVALID_FORMAT;
+    }
 
     t = _hx509_Time2time_t(crl->tbsCertList.nextUpdate);
-    if (t < time_now)
+    if (t < time_now) {
+	hx509_set_error_string(context, HX509_CRL_USED_AFTER_TIME,
+			       "CRL used after time");
 	return HX509_CRL_USED_AFTER_TIME;
+    }
 
     _hx509_query_clear(&q);