I've configured syslog-ng 3.35.1 to use CRLs but things aren't working as expected. This is what I've done : 1. Create a self-signed CA and use it to sign a server certificate. The server certificate has a CRL distribution point in it. 2. Revoke the server certificate. Generate the revoked CRL and put it on the syslog client under /etc/syslog-ng/crl in PEM format. There's a <issuer hash>.r0 link to the CRL in this directory. 3. Configure ca-dir and crl-dir in the client's syslog config. Configure the client to connect to the remote syslog server. With this setup, I' d expect the syslog client to reject the server certificate since it's revoked, but that doesn't happen. The TLS handshake and subsequent communication is successful. Is there anything that I'm missing ? Any pointers will be appreciated. I can provide additional details of my setup if needed. Thanks! Shankar.