X.509 validation with CRL, but no OCSP

OpensslCertChainValidator with CRL IF_VALID and OCSP IGNORE by default.
GGUS ticket: https://ggus.eu/index.php?mode=ticket_info&ticket_id=105666
v1.4.1-0 (RC1)