Fix ca_location fetch_crl default bug

Turns out we weren't accounting for explicit configuration of
ca_location=local. This commit fixes that oversight.