The revocation checking on shared instance has been modified to use OCSP. The authentication code has been modified such that if the RA subsystem is missing it will throw an exception and then fail the authentication. The CMSEngine.isRevoked() has been modified to pass exceptions to the caller. https://fedorahosted.org/pki/ticket/1202 https://fedorahosted.org/pki/ticket/1250 Note: no need to review until 10.3. -- Endi S. Dewata