ensure crl exists, even if empty, so we can start