code: @SuppressWarnings("unchecked")
      public X509CRL getRevocationList(final X509Certificate identity,
              final PrivateKey key, final X500Principal issuer,
              final BigInteger serial, final String profile)
              throws ClientException, OperationFailureException {
          LOGGER.debug("Retriving CRL from CA");
          // TRANSACTIONAL
          // CRL query
          checkDistributionPoints(profile);
  
          X500Name name = X500Utils.toX500Name(issuer);
          IssuerAndSerialNumber iasn = new IssuerAndSerialNumber(name, serial);
          Transport transport = createTransport(profile);
          final Transaction t = new NonEnrollmentTransaction(transport,
                  getEncoder(identity, key, profile), getDecoder(identity, key,
                          profile), iasn, MessageType.GET_CRL);
          State state;
          try {
              state = t.send();
          } catch (TransactionException e) {
              throw new ClientException(e);
          }
  
          if (state == State.CERT_ISSUED) {
              try {
                  Collection<X509CRL> crls = (Collection<X509CRL>) t
                          .getCertStore().getCRLs(null);
                  if (crls.size() == 0) {
                      return null;
                  }
                  return crls.iterator().next();
              } catch (CertStoreException e) {
                  throw new RuntimeException(e);
              }
          } else if (state == State.CERT_REQ_PENDING) {
              throw new IllegalStateException();
          } else {
              throw new OperationFailureException(t.getFailInfo());
          }
      }
docs: Returns the certificate revocation list a given issuer and serial number.
  <p>
  This method requests a CRL for a certificate as identified by the issuer
  name and the certificate serial number.
  <p>
  This method provides support for SCEP servers with multiple profiles.
  
  @param identity
  the identity of the client.
  @param key
  the private key to sign the SCEP request.
  @param issuer
  the name of the certificate issuer.
  @param serial
  the serial number of the certificate.
  @param profile
  the SCEP server profile.
  @return the CRL corresponding to the issuer and serial.
  @throws ClientException
  if any client errors occurs.
  @throws OperationFailureException
  if the request fails.