  <varlistentry>
  <term><emphasis remap='B'>crl-strict</emphasis></term>
  <listitem>
<para>if not set, pluto is tolerant about missing or expired X.509 Certificate
Revocation Lists (CRL's), and will allow peer certificates as long as they
do not appear on an expired CRL. When this option is enabled, all connections
with an expired or missing CRL will be denied. Active connections will be
terminated at rekey time. This setup is more secure, but vulnerable to downtime
if the CRL expires. Acceptable values are <emphasis remap='B'>yes</emphasis>
or <emphasis remap='B'>no</emphasis> (the default). This option used to be
called strictcrlpolicy.
</para>
  </listitem>
  </varlistentry>

