Having set two way SSL Elytron server-ssl-context [1] but with trust-managers with certificate-revocation-list set [2] (and algorithm unset), a client is able to connect to the server even though the client certificate has too long certificate path.

Debugging reveals that X509CRLExtendedTrustManager.checkClientTrusted do not throw CertificateException even though CRL entries from file are loaded and maximum-cert-path is set.

The CRL functionality is required by EAP7-203, hence Critical priority is set.

[1] https://docs.jboss.org/author/display/WFLY/WildFly+Elytron+Security#WildFlyElytronSecurity-EnableTwowaySSL%2FTLSinWildFlyforApplications
[2] https://docs.jboss.org/author/display/WFLY/SSL+Configuration+using+Elytron+Subsystem#SSLConfigurationusingElytronSubsystem-UsingaCertificateRevocationList