The "Certificate Authorities" page in the RA GUI contains download links for the CRLs for the CAs. These links go to the CRLStoreServlet. There are two possible reasons why a CRL might not be possible to download:
- the CRL is not available locally (in this case the link is completely absent)
- the issuing CA certificate of the CRL is not available in the local database (in this case the link is present, but the servlet throws an exception)
In these two cases we should instead look at the CRL Distribution Point inside the CA certificate, and use that as the link.