create CRL according to CommonPKI 2.0