If multiple valid CRLs are specified for a particular issuer, only the first will be checked. The documentation didn’t really hint at this. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>