If depending on CRL reloads, then you could consider the following property for the JDK: -Dcom.sun.security.enableCRLDP=true The JDK will then check any CRLDistributionPoints that may be in the client certificate. Note that this then results in the JDK having to download the CRL from the distribution point through calls here . That is checked with a cache of 30 seconds by default here so there is a limit to checks but handshakes are still then nonetheless directly subject to possible latency and responsiveness of the CRL distribution point.