(#17864) Don't check certificate_revocation if configured not to (rebased)

A rebased version of #1498, replete with tests.