Just a minor comment, in the last (or the one before the last) EUGridPMA meeting there was discussion regarding the 
cRLDistributionPoints extension. The pointed file should be a DER formatted CRL file in order to be parsed correctly by 
all clients (i.e. Apple keychain doesn't recognise PEM formatted CRLs). As far as i know this was also added to the last
 RFC draft document regarding the X509 Certificate Profile.