Hi Michael, > I loaded the CRLs in the "wrong" order via vici, ran ipsec purgecrls ran my test and its all working fine. Great, thanks for testing. I merged the two patches to master so they'll be included in the upcoming 5.3.4 release. Regards, Tobias