### No certificate, certificate required ### No certificate, certificate optional at TLS time, required by ACL ### Good certificate, certificate required ### Good certificate, certificate optional at TLS time, checked by ACL ### Bad certificate, certificate required ### Bad certificate, certificate optional at TLS time, reject at ACL time ### Otherwise good but revoked certificate, certificate required ### Revoked certificate, certificate optional at TLS time, reject at ACL time ### Good certificate, certificate required - but nonmatching CRL also present ******** SERVER ******** ### No certificate, certificate required ### No certificate, certificate optional at TLS time, required by ACL ### Good certificate, certificate required ### Good certificate, certificate optional at TLS time, checked by ACL ### Bad certificate, certificate required ### Bad certificate, certificate optional at TLS time, reject at ACL time ### Otherwise good but revoked certificate, certificate required ### Revoked certificate, certificate optional at TLS time, reject at ACL time ### Good certificate, certificate required - but nonmatching CRL also present