Hi Paul, If ipsec certificate is revoked in CRL, as expected openswan tears down connection. After this, will openswan bring the connection up if the CRL is updated to not revoke the certificate again? Thanks, James