(PE-3914) Allowed setting CRL path

Let me know if my test coverage isn't thorough enough. I burned up a bunch of time trying to actually add a cert to a revocation list, but realized the CA's private key isn't committed here anywhere so that was a no-go.