Hi Anthony, > If we have a CRL the revoked a "secure gateway", and later the CRL expired. > > ? will strongswan still use the expired CRL It does. But if you use strict revocation checking, a fresh CRL is required to validate non-revoked certificates. Regards, Tobias