for crl distribution only