Index: icinga2-2.8.2/lib/base/tlsutility.cpp
===================================================================
--- icinga2-2.8.2.orig/lib/base/tlsutility.cpp
+++ icinga2-2.8.2/lib/base/tlsutility.cpp
@@ -210,16 +210,28 @@ void SetTlsProtocolminToSSLContext(const
 }
 
 /**
- * Loads a CRL and appends its certificates to the specified SSL context.
+ * Loads a CRL and appends its certificates to the specified Boost SSL context.
  *
  * @param context The SSL context.
  * @param crlPath The path to the CRL file.
  */
 void AddCRLToSSLContext(const boost::shared_ptr<SSL_CTX>& context, const String& crlPath)
 {
-	char errbuf[120];
 	X509_STORE *x509_store = SSL_CTX_get_cert_store(context.get());
 
+	AddCRLToSSLContext(x509_store, crlPath);
+}
+
+/**
+ * Loads a CRL and appends its certificates to the specified OpenSSL X509 store.
+ *
+ * @param context The SSL context.
+ * @param crlPath The path to the CRL file.
+ */
+void AddCRLToSSLContext(X509_STORE *x509_store, const String& crlPath)
+{
+	char errbuf[256];
+
 	X509_LOOKUP *lookup;
 	lookup = X509_STORE_add_lookup(x509_store, X509_LOOKUP_file());
 
@@ -741,7 +753,7 @@ String RandomString(int length)
 	return result;
 }
 
-bool VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate)
+bool VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate, const String& crlFile)
 {
 	X509_STORE *store = X509_STORE_new();
 
@@ -750,6 +762,10 @@ bool VerifyCertificate(const boost::shar
 
 	X509_STORE_add_cert(store, caCertificate.get());
 
+	if (!crlFile.IsEmpty()) {
+		AddCRLToSSLContext(store, crlFile);
+	}
+
 	X509_STORE_CTX *csc = X509_STORE_CTX_new();
 	X509_STORE_CTX_init(csc, store, certificate.get(), NULL);
 
Index: icinga2-2.8.2/lib/base/tlsutility.hpp
===================================================================
--- icinga2-2.8.2.orig/lib/base/tlsutility.hpp
+++ icinga2-2.8.2/lib/base/tlsutility.hpp
@@ -40,6 +40,7 @@ namespace icinga
 void I2_BASE_API InitializeOpenSSL(void);
 boost::shared_ptr<SSL_CTX> I2_BASE_API MakeSSLContext(const String& pubkey = String(), const String& privkey = String(), const String& cakey = String());
 void I2_BASE_API AddCRLToSSLContext(const boost::shared_ptr<SSL_CTX>& context, const String& crlPath);
+void AddCRLToSSLContext(X509_STORE *x509_store, const String& crlPath);
 void I2_BASE_API SetCipherListToSSLContext(const boost::shared_ptr<SSL_CTX>& context, const String& cipherList);
 void I2_BASE_API SetTlsProtocolminToSSLContext(const boost::shared_ptr<SSL_CTX>& context, const String& tlsProtocolmin);
 String I2_BASE_API GetCertificateCN(const boost::shared_ptr<X509>& certificate);
@@ -56,7 +57,7 @@ String I2_BASE_API PBKDF2_SHA256(const S
 String I2_BASE_API SHA1(const String& s, bool binary = false);
 String I2_BASE_API SHA256(const String& s);
 String I2_BASE_API RandomString(int length);
-bool I2_BASE_API VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate);
+bool I2_BASE_API VerifyCertificate(const boost::shared_ptr<X509>& caCertificate, const boost::shared_ptr<X509>& certificate, const String& crlFile);
 bool I2_BASE_API ComparePassword(const String& hash, const String& password, const String& Salt);
 String I2_BASE_API CreateHashedPasswordString(const String& password, const String& salt, int algorithm = 5);
 
Index: icinga2-2.8.2/lib/remote/jsonrpcconnection-pki.cpp
===================================================================
--- icinga2-2.8.2.orig/lib/remote/jsonrpcconnection-pki.cpp
+++ icinga2-2.8.2/lib/remote/jsonrpcconnection-pki.cpp
@@ -57,7 +57,27 @@ Value RequestCertificateHandler(const Me
 
 	String cn = GetCertificateCN(cert);
 
-	bool signedByCA = VerifyCertificate(cacert, cert);
+	bool signedByCA = false;
+
+        {
+                Log logmsg(LogInformation, "JsonRpcConnection");
+                logmsg << "Received certificate request for CN '" << cn << "'";
+
+                try {
+                        signedByCA = VerifyCertificate(cacert, cert, listener->GetCrlPath());
+                        if (!signedByCA) {
+                                logmsg << " not";
+                        }
+                        logmsg << " signed by our CA.";
+                } catch (const std::exception &ex) {
+                        logmsg << " not signed by our CA";
+                        if (const unsigned long *openssl_code = boost::get_error_info<errinfo_openssl_error>(ex)) {
+                                logmsg << ": " << X509_verify_cert_error_string(long(*openssl_code)) << " (code " << *openssl_code << ")";
+                        } else {
+                                logmsg << ".";
+                        }
+                }
+        }
 
 	Log(LogInformation, "JsonRpcConnection")
 	    << "Received certificate request for CN '" << cn << "'"
@@ -178,7 +198,7 @@ Value RequestCertificateHandler(const Me
 	 * this ensures that the CA we have in /var/lib/icinga2/ca matches the one
 	 * we're using for cluster connections (there's no point in sending a client
 	 * a certificate it wouldn't be able to use to connect to us anyway) */
-	if (!VerifyCertificate(cacert, newcert)) {
+	if (!VerifyCertificate(cacert, newcert, listener->GetCrlPath())) {
 		Log(LogWarning, "JsonRpcConnection")
 		    << "The CA in '" << listener->GetDefaultCaPath() << "' does not match the CA which Icinga uses "
 		    << "for its own cluster connections. This is most likely a configuration problem.";
