Make sure at least an empty CRL exists, and verify client connections against it