code: func certIsRevokedCRL(cert *x509.Certificate, url string) (revoked, ok bool, err error) {
  	crl, ok := CRLSet[url]
  	if ok && crl == nil {
  		ok = false
  		crlLock.Lock()
  		delete(CRLSet, url)
  		crlLock.Unlock()
  	}
  
  	var shouldFetchCRL = true
  	if ok {
  		if !crl.HasExpired(time.Now()) {
  			shouldFetchCRL = false
  		}
  	}
  
  	issuer := getIssuer(cert)
  
  	if shouldFetchCRL {
  		var err error
  		crl, err = fetchCRL(url)
  		if err != nil {
  			log.Warningf("failed to fetch CRL: %v", err)
  			return false, false, err
  		}
  
  		// check CRL signature
  		if issuer != nil {
  			err = issuer.CheckCRLSignature(crl)
  			if err != nil {
  				log.Warningf("failed to verify CRL: %v", err)
  				return false, false, err
  			}
  		}
  
  		crlLock.Lock()
  		CRLSet[url] = crl
  		crlLock.Unlock()
  	}
  
  	for _, revoked := range crl.TBSCertList.RevokedCertificates {
  		if cert.SerialNumber.Cmp(revoked.SerialNumber) == 0 {
  			log.Info("Serial number match: intermediate is revoked.")
  			return true, true, err
  		}
  	}
  
  	return false, true, err
  }
docs: // check a cert against a specific CRL. Returns the same bool pair
  // as revCheck, plus an error if one occurred.