Absolutely!  Generally, I think as long as CRL or certificate is valid, cached resource is good enough. But this is much bigger change ( especially as we want it to have in 2.0 branch. I suggest to deprecate  CoGProperties#getCRLCacheLifetime, and introduce new CoGProperties#getResourceCacheLifetime and use it for both. As alternative, AbstractResourceSecurityWrapper can take an attribute in the constructor, and caller will provide the corresponding timeout value. But this is bit ugly.