Merge pull request #3562 from raoulstrackx/raoul/verify_crl_without_time_bp2.16

Backport 2.16: Always revoke certificate on CRL