How often to check should probably be configurable. See CogProperties#getCRLCacheLifetime() for an existing setting of this kind. One challenge here is that AbstractResourceSecurityWrapper is used for several different types of resources, e.g. for both CRL and certificates. The question is whether to use different configuration properties for each type of resource, or whether to replace CoGProperties#getCRLCacheLifetime with a single new property that applies to all reloadable resources.