Just a sample, real world applications would have to be cleverer.

Use -1 to check all extensions in CRLs.
Always set flag for freshest CRL.

Add new verify options to set checks.

Remove previous -check* commands from s_client and s_server.

is needed to test some profiles/protocols which reject certificates
with unsupported versions.

Submitted by: jean-etienne.schwartz@bull.net

In OCSP_basic_varify return an error if X509_STORE_CTX_init fails.

structures using HTTP. Add wrapper function to handle CRL download.