Let’s wait till tomorrow and if it’s not fixed by then, I will merge this PR.

We would need to generate a CA including CRL, should be possible statically or dynamically, but would require some extra work on systems there the OS certificate store is used.

Still, we've at least traditionally have had users run the test suite on machines without internet access, we might be causing undesired traffic to this site and we may at times get undesired test failures.

The test as it is now only applies to WinSSL. If the --cacert option is used with a local CA with no revocation information (CRL, AIA, ???) then it should fail unless --ssl-no-revoke is used.

@bagder: I am with you. I was completely surprised that this test case relies on some online service. This also leaks information about test suits users to that online service.

I did it. At the time there was no way to test --ssl-no-revoke with WinSSL since there was no support for user-specified CAs, so I settled on an internet server.

@jay @bagder thanks for your input, but for now it would be okay to merge this to get the test going again, right?

Yes I'm fine with that.