Provide more info when crl-check fails.

Are we sure we'll always have a 'CN' containing at least 1 entry?