openvpn doesn't like empty crl