Would anyone know how to get openssl s_client (1.0.2k) to fetch a crl when the CDP extension is present in the remote server certificate? I have tried -crl_check and -crl_download but that didn't work. -crl_check seems to only like when the crl is appended to the ca file (with -CAfile option). -crl_download doesn't do anything with s_client. I checked the cert with Openssl verify and the option works and sees the cert is being revoked. I'm really not sure where to go from there.