You can tidy up the backend storage and/or CRL by removing certificates that have expired and are past a certain buffer period beyond their expiration time.
{{else if (eq section "crl")}}Set the duration for which the generated CRL should be marked valid.
{{/if}} {{message-error model=config}}