Implement support for CRLs.

Fixes #3657
Fix compatibility with OpenSSL <1.0.0.

Refs #3657
Remove inconsistent Changelog from spec.