anchor.diff:          " -out ", CertPath]),
   
       ?info("~s", [SigningOutput]),
  +    ?info("Generating an empty CRL..."),
  +
  +    CrlGenerationOutput = os:cmd(["openssl ca",
  +        " -config ", CaConfigFile,
  +        " -gencrl",
  +        " -out ", filename:join(CaDir, "crl.pem")]),
  +
  +    ?info("~s", [CrlGenerationOutput]),
   
       mochitemp:rmtempdir(TmpDir),
       ok.
  
positive.code:         " -revoke ", filename:join([CaDir, "newcerts", Serial]), ".pem"]),
      ?info("~s", [RevokeOutput]),
      ?info("Generating an updated CRL"),
      CreateCrlOutput = os:cmd(["openssl ca"
          " -config ", CaConfigFile,
          " -gencrl",
          " -out ", filename:join(CaDir, "crl.pem")]),
      ?info(CreateCrlOutput),
      ok.
  
  
  
negative.code: -spec verify_provider(PeerCertDer :: public_key:der_encoded()) ->
      {ok, ProviderId :: binary()} | {error, {bad_cert, Reason :: atom()}}.
  %% ====================================================================
  verify_provider(PeerCertDer) ->
      case delegate(verify_provider, {PeerCertDer}) of
          {ok, ProviderId} = Result when is_binary(ProviderId) -> Result;
          {error, {bad_cert, Reason}} = Result when is_atom(Reason) -> Result
  